carpathianflorist
/
MarseyWorld
forked from MarseyWorld/MarseyWorld
1
0
Fork 0
Code Pull Requests Activity

add comments to remind myself

master
Aevann 2024-02-12 09:18:43 +02:00
parent ab2464e834
commit 07b6f25ed5
5 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
files/assets/js/bottom.js
View File

@ -238,7 +238,7 @@ document.addEventListener("click", function (e) {
}
if (!element.classList.contains("areyousure")) {
if (element.dataset.nonce != nonce) {
if (element.dataset.nonce != nonce) { //to stop the oldhtml attribute from being used as a vector for html injections
console.error("Nonce check failed!")
return
}

2
files/assets/js/core.js
View File

@ -251,7 +251,7 @@ function timestamp(t, ti) {
};
function areyousure(t) {
if (t.dataset.nonce != nonce) {
if (t.dataset.nonce != nonce) { //to stop the oldhtml attribute from being used as a vector for html injections
console.error("Nonce check failed!")
return
}

2
files/classes/comment.py
View File

@ -426,7 +426,7 @@ class Comment(Base):
body = normalize_urls_runtime(body, v)
body = bleach_body_html(body, runtime=True)
body = bleach_body_html(body, runtime=True) #to stop slur filters and poll options being used as a vector for html/js injection
return body

2
files/classes/post.py
View File

@ -325,7 +325,7 @@ class Post(Base):
body = normalize_urls_runtime(body, v)
body = bleach_body_html(body, runtime=True)
body = bleach_body_html(body, runtime=True) #to stop slur filters and poll options being used as a vector for html/js injection
return body

2
files/helpers/slurs_and_profanities.py
View File

@ -5,6 +5,7 @@ tranny = f'<img loading="lazy" data-bs-toggle="tooltip" alt=":marseytrain:" titl
trannie = f'<img loading="lazy" data-bs-toggle="tooltip" alt=":!marseytrain:" title=":!marseytrain:" src="{SITE_FULL_IMAGES}/e/marseytrain.webp">'
troon = f'<img loading="lazy" data-bs-toggle="tooltip" alt=":marseytrain2:" title=":marseytrain2:" src="{SITE_FULL_IMAGES}/e/marseytrain2.webp">'
#DON'T ADD ANY FILTERS WITH ' OR ", VECTOR FOR HTML INJECTION
SLURS = {
"tranny": tranny,
"trannie": trannie,
@ -30,6 +31,7 @@ SLURS = {
"dykes": "cute butches",
}
#DON'T ADD ANY FILTERS WITH ' OR ", VECTOR FOR HTML INJECTION
if SITE_NAME == 'rDrama':
SLURS |= {
"retarded": "r-slurred",