sfd

files/helpers/sanitize.py

@@ -165,7 +165,7 @@ def sanitize(sanitized, noimages=False, alert=False, comment=False, edit=False):
 									]
 							).clean(sanitized)
 
-	soup = BeautifulSoup(sanitized, 'xml')
+	soup = BeautifulSoup(sanitized, 'html.parser')
 
 	for tag in soup.find_all("img"):
 		if tag.get("src") and tag.get("class") != ['pp20']:

files/routes/comments.py

@@ -222,8 +222,10 @@ def api_comment(v):
 					try:
 						badge_def = loads(body)
 						name = badge_def["name"]
-						badge = g.db.query(BadgeDef).filter_by(name=name).one_or_none()
-						if not badge:
+
+						existing = g.db.query(BadgeDef).filter_by(name=name).one_or_none()
+						if existing: return {"error": "A badge with this name already exists!"}
+
 						badge = BadgeDef(name=name, description=badge_def["description"])
 						g.db.add(badge)
 						g.db.flush()
@@ -240,7 +242,10 @@ def api_comment(v):
 						if "author" in marsey: author_id = get_user(marsey["author"]).id
 						elif "author_id" in marsey: author_id = marsey["author_id"]
 						else: abort(400)
-						if not g.db.query(Marsey.name).filter_by(name=name).one_or_none():
+
+						existing = g.db.query(Marsey.name).filter_by(name=name).one_or_none()
+						if existing: return {"error": "A marsey with this name already exists!"}
+
 						marsey = Marsey(name=marsey["name"], author_id=author_id, tags=marsey["tags"], count=0)
 						g.db.add(marsey)
 						filename = f'files/assets/images/emojis/{name}.webp'