','').replace('','')
+
+
+ allowed_tags = ['b','blockquote','br','code','del','em','h1','h2','h3','h4','h5','h6','hr','i','li','ol','p','pre','strong','sub','sup','table','tbody','th','thead','td','tr','ul','marquee','a','span','ruby','rp','rt','spoiler']
+ if not noimages: allowed_tags += ['img','video','lite-youtube','source']
+
+ def allowed_attributes(tag, name, value):
+
+ if name == 'style': return True
+
+ if tag == 'marquee':
+ if name in ['direction', 'behavior', 'scrollamount']: return True
+ if name in {'height', 'width'}:
+ try: value = int(value.replace('px', ''))
+ except: return False
+ if 0 < value <= 250: return True
+ return False
+
+ if tag == 'a':
+ if name == 'href': return True
+ if name == 'rel' and value == 'nofollow noopener noreferrer': return True
+ if name == 'target' and value == '_blank': return True
+ return False
+
+ if tag == 'img':
+ if name == 'loading' and value == 'lazy': return True
+ if name == 'referrpolicy' and value == 'no-referrer': return True
+ if name == 'data-bs-toggle' and value == 'tooltip': return True
+ if name in ['src','data-src','alt','title','g','b']: return True
+ return False
+
+ if tag == 'lite-youtube':
+ if name == 'params' and value.startswith('autoplay=1&modestbranding=1'): return True
+ if name == 'videoid': return True
+ return False
+
+ if tag == 'video':
+ if name == 'controls' and value == '': return True
+ if name == 'preload' and value == 'none': return True
+ return False
+
+ if tag == 'source':
+ if name == 'src': return True
+ return False
+
+
+
+ sanitized = bleach.Cleaner(tags=allowed_tags,
+ attributes=allowed_attributes,
+ protocols=['http', 'https'],
+ styles=['color', 'background-color', 'font-weight', 'text-align'],
+ filters=[partial(LinkifyFilter,skip_tags=["pre"],parse_email=False)]
+ ).clean(sanitized)
+
+
+
signal.alarm(0)
return sanitized
-def handler2(signum, frame):
- print("Forever is over!")
- raise Exception("end of time")
+
+
+
def filter_emojis_only(title, edit=False, graceful=False):
- signal.signal(signal.SIGALRM, handler2)
+ def handler(signum, frame):
+ print("Timeout!")
+ raise Exception("Timeout")
+
+ signal.signal(signal.SIGALRM, handler)
signal.alarm(1)
- title = title.replace('','').replace('','').replace("\ufeff", "").replace("𒐪","").replace("\n", "").replace("\r", "").replace("\t", "").replace("","").replace("&", "&").replace('<','<').replace('>','>').replace('"', '"').replace("'", "'").strip()
-
- title = bleach.clean(title, tags=[])
+ title = title.replace('','').replace('','').replace("\ufeff", "").replace("𒐪","").replace("\n", "").replace("\r", "").replace("\t", "").replace("&", "&").replace('<','<').replace('>','>').replace('"', '"').replace("'", "'").strip()
emojis = list(emoji_regex4.finditer(title))
if len(emojis) > 20: edit = True
@@ -364,35 +285,35 @@ def filter_emojis_only(title, edit=False, graceful=False):
captured.append(i.group(0))
emoji = i.group(1).lower()
+ golden = ' '
+ if not edit and random() < 0.0025 and ('marsey' in emoji or emoji in marseys_const2): golden = 'g '
- if emoji.startswith("!"):
- emoji = emoji[1:]
- classes = 'emoji mirrored'
- if not edit and random() < 0.0025 and ('marsey' in emoji or emoji in marseys_const2): classes += ' golden'
-
- old = emoji
- if emoji == 'marseyrandom': emoji = choice(marseys_const2)
- else: emoji = old
- old = '!' + emoji
- else:
- classes = 'emoji'
- if not edit and random() < 0.0025 and ('marsey' in emoji or emoji in marseys_const2): classes += ' golden'
-
- old = emoji
- if emoji == 'marseyrandom': emoji = choice(marseys_const2)
- else: emoji = old
-
+ old = emoji
+ emoji = emoji.replace('!','').replace('#','')
+ if emoji == 'marseyrandom': emoji = choice(marseys_const2)
if path.isfile(f'files/assets/images/emojis/{emoji}.webp'):
- title = re.sub(f'(?', title, flags=re.I|re.A)
+ title = re.sub(f'(?', title, flags=re.I|re.A)
elif emoji.endswith('pat') and path.isfile(f"files/assets/images/emojis/{emoji.replace('pat','')}.webp"):
pat(emoji.replace('pat',''))
- title = re.sub(f'(?', title, flags=re.I|re.A)
+ title = re.sub(f'(?', title, flags=re.I|re.A)
requests.post(f'https://api.cloudflare.com/client/v4/zones/{CF_ZONE}/purge_cache', headers=CF_HEADERS, data={'files': [f"https://{request.host}/e/{emoji}.webp"]}, timeout=5)
title = strikethrough_regex.sub(r'\1', title)
+
+ def allowed_attributes(tag, name, value):
+
+ if tag == 'img':
+ if name == 'loading' and value == 'lazy': return True
+ if name == 'data-bs-toggle' and value == 'tooltip': return True
+ if name in ['src','alt','title','g']: return True
+ return False
+
+
+ sanitized = bleach.clean(title, tags=['img','del'], attributes=allowed_attributes, protocols=['http','https'])
+
signal.alarm(0)
if len(title) > 1500 and not graceful: abort(400)
diff --git a/files/templates/authforms.html b/files/templates/authforms.html
index 79d6ad88c..2a8de8a7c 100644
--- a/files/templates/authforms.html
+++ b/files/templates/authforms.html
@@ -15,7 +15,7 @@
{% if v %}
-
+
{% if v.agendaposter %}
-
+
{% endif %}
diff --git a/files/templates/chat.html b/files/templates/chat.html
index 3743a0c86..660fe4313 100644
--- a/files/templates/chat.html
+++ b/files/templates/chat.html
@@ -14,7 +14,7 @@
Chat
-
+
{% if v.css %}
@@ -197,7 +197,7 @@
{% include "emoji_modal.html" %}
{% include "expanded_image_modal.html" %}
-
+
\ No newline at end of file
diff --git a/files/templates/default.html b/files/templates/default.html
index 998b458b5..75cca4b24 100644
--- a/files/templates/default.html
+++ b/files/templates/default.html
@@ -7,7 +7,7 @@