diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py index 419a81848..4266079e2 100644 --- a/files/helpers/sanitize.py +++ b/files/helpers/sanitize.py @@ -254,11 +254,9 @@ def sanitize(sanitized, noimages=False): return sanitized -def filter_title(title): - title = title.strip() - title = title.replace("\n", "") - title = title.replace("\r", "") - title = title.replace("\t", "") +def filter_emojis_only(title): + + title = title.replace('<','').replace('>','').replace("\n", "").replace("\r", "").replace("\t", "").strip() title = bleach.clean(title, tags=[]) diff --git a/files/routes/awards.py b/files/routes/awards.py index 716cb4bad..bc045936b 100644 --- a/files/routes/awards.py +++ b/files/routes/awards.py @@ -6,7 +6,7 @@ from files.helpers.const import * from files.classes.award import * from .front import frontlist from flask import g, request -from files.helpers.sanitize import filter_title +from files.helpers.sanitize import filter_emojis_only discounts = { 69: 0.02, @@ -542,7 +542,7 @@ def award_post(pid, v): elif kind == "flairlock": new_name = note[:100].replace("𒐪","") author.customtitleplain = new_name - author.customtitle = filter_title(new_name) + author.customtitle = filter_emojis_only(new_name) if len(author.customtitle) > 1000: abort(403) author.flairchanged = time.time() + 86400 elif kind == "pause": @@ -696,7 +696,7 @@ def award_comment(cid, v): elif kind == "flairlock": new_name = note[:100].replace("𒐪","") author.customtitleplain = new_name - author.customtitle = filter_title(new_name) + author.customtitle = filter_emojis_only(new_name) if len(author.customtitle) > 1000: abort(403) author.flairchanged = time.time() + 86400 elif kind == "pause": diff --git a/files/routes/comments.py b/files/routes/comments.py index f51ec5fc3..fd0999802 100644 --- a/files/routes/comments.py +++ b/files/routes/comments.py @@ -9,7 +9,7 @@ from files.routes.front import comment_idlist from pusher_push_notifications import PushNotifications from flask import * from files.__main__ import app, limiter -from files.helpers.sanitize import filter_title +from files.helpers.sanitize import filter_emojis_only site = environ.get("DOMAIN").strip() if site == 'pcmemes.net': cc = "SPLASH MOUNTAIN" @@ -297,7 +297,7 @@ def api_comment(v): parent_submission=parent_submission, parent_comment_id=c.id, level=level+1, - body_html=filter_title(option), + body_html=filter_emojis_only(option), upvotes=0 ) @@ -657,7 +657,7 @@ def edit_comment(cid, v): parent_submission=c.parent_submission, parent_comment_id=c.id, level=c.level+1, - body_html=filter_title(i.group(1)), + body_html=filter_emojis_only(i.group(1)), upvotes=0 ) g.db.add(c_option) diff --git a/files/routes/posts.py b/files/routes/posts.py index 3fa301946..f1d431ae2 100644 --- a/files/routes/posts.py +++ b/files/routes/posts.py @@ -372,7 +372,7 @@ def edit_post(pid, v): title = title.replace('I ', f'@{v.username} ') title = censor_slurs2(title).upper().replace(' ME ', f' @{v.username} ') - title_html = filter_title(title) + title_html = filter_emojis_only(title) if v.marseyawarded and len(list(re.finditer('>[^<\s+]|[^>\s+]<', title_html))) > 0: return {"error":"You can only type marseys!"}, 403 p.title = title p.title_html = title_html @@ -402,7 +402,7 @@ def edit_post(pid, v): c = Comment(author_id=AUTOPOLLER_ID, parent_submission=p.id, level=1, - body_html=filter_title(i.group(1)), + body_html=filter_emojis_only(i.group(1)), upvotes=0 ) g.db.add(c) @@ -681,7 +681,7 @@ def submit_post(v): title = title.replace('I ', f'@{v.username} ') title = censor_slurs2(title).upper().replace(' ME ', f' @{v.username} ') - title_html = filter_title(title) + title_html = filter_emojis_only(title) body = request.values.get("body", "").strip() if v.marseyawarded and len(list(re.finditer('>[^<\s+]|[^>\s+]<', title_html))) > 0: return {"error":"You can only type marseys!"}, 40 @@ -921,7 +921,7 @@ def submit_post(v): c = Comment(author_id=AUTOPOLLER_ID, parent_submission=new_post.id, level=1, - body_html=filter_title(option), + body_html=filter_emojis_only(option), upvotes=0 ) diff --git a/files/routes/reporting.py b/files/routes/reporting.py index f38a84022..2cc2b3763 100644 --- a/files/routes/reporting.py +++ b/files/routes/reporting.py @@ -3,6 +3,7 @@ from files.helpers.get import * from flask import g from files.__main__ import app, limiter from os import path +from files.helpers.sanitize import filter_emojis_only @app.post("/report/post/") @limiter.limit("1/second") @@ -13,15 +14,12 @@ def api_flag_post(pid, v): if not v.shadowbanned: reason = request.values.get("reason", "").strip()[:100] - if "<" in reason: return {"error": f"Reasons can't contain <"} if not reason.startswith('!'): existing = g.db.query(Flag.id).filter_by(user_id=v.id, post_id=post.id).first() if existing: return "", 409 - for i in re.finditer(':(.{1,30}?):', reason): - if path.isfile(f'./files/assets/images/emojis/{i.group(1)}.webp'): - reason = reason.replace(f':{i.group(1)}:', f':{i.group(1)}:') + reason = filter_emojis_only(reason) if len(reason) > 350: return {"error": f"Too long."} @@ -45,26 +43,17 @@ def api_flag_comment(cid, v): comment = get_comment(cid) if not v.shadowbanned: - existing = g.db.query(CommentFlag.id).filter_by( - user_id=v.id, comment_id=comment.id).first() - + existing = g.db.query(CommentFlag.id).filter_by( user_id=v.id, comment_id=comment.id).first() if existing: return "", 409 - reason = request.values.get("reason", "").strip()[:100] - if "<" in reason: return {"error": f"Reasons can't contain <"} - for i in re.finditer(':(.{1,30}?):', reason): - if path.isfile(f'./files/assets/images/emojis/{i.group(1)}.webp'): - reason = reason.replace(f':{i.group(1)}:', f':{i.group(1)}:') + reason = request.values.get("reason", "").strip()[:100] + reason = filter_emojis_only(reason) if len(reason) > 350: return {"error": f"Too long."} - flag = CommentFlag(comment_id=comment.id, - user_id=v.id, - reason=reason, - ) + flag = CommentFlag(comment_id=comment.id, user_id=v.id, reason=reason) g.db.add(flag) - g.db.commit() return {"message": "Comment reported!"} diff --git a/files/routes/settings.py b/files/routes/settings.py index 5dab1f9d6..06c6a9ae9 100644 --- a/files/routes/settings.py +++ b/files/routes/settings.py @@ -10,7 +10,7 @@ from files.__main__ import app, cache, limiter import youtube_dl from .front import frontlist import os -from files.helpers.sanitize import filter_title +from files.helpers.sanitize import filter_emojis_only from files.helpers.discord import add_role from shutil import copyfile import requests @@ -1074,7 +1074,7 @@ def settings_title_change(v): v.customtitleplain = new_name - v.customtitle = filter_title(new_name) + v.customtitle = filter_emojis_only(new_name) if len(v.customtitle) < 1000: g.db.add(v)