From e2812623538fefc8217cd8fb785233141d8e570b Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 21:53:38 +0200 Subject: [PATCH 01/14] sffsd --- files/helpers/sanitize.py | 2 +- files/templates/formatting.html | 6 ------ files/templates/submission.html | 4 ++-- 3 files changed, 3 insertions(+), 9 deletions(-) diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py index ee09b768d..8f1cc692f 100644 --- a/files/helpers/sanitize.py +++ b/files/helpers/sanitize.py @@ -84,7 +84,7 @@ def sanitize_marquee(tag, name, value): return False allowed_attributes = { - '*': ['href', 'style', 'src', 'class', 'title', 'rel', 'data-bs-original-name'], + '*': ['href', 'style', 'src', 'class', 'title'], 'marquee': sanitize_marquee} allowed_protocols = ['http', 'https'] diff --git a/files/templates/formatting.html b/files/templates/formatting.html index 07f055ef7..ee9778732 100644 --- a/files/templates/formatting.html +++ b/files/templates/formatting.html @@ -475,12 +475,6 @@ line breaks title - - rel - - - data-bs-original-name - direction diff --git a/files/templates/submission.html b/files/templates/submission.html index fb1454463..9727e328b 100644 --- a/files/templates/submission.html +++ b/files/templates/submission.html @@ -417,9 +417,9 @@ {% if p.domain == "twitter.com" %} {{p.embed_url | safe}} {% if v and v.theme.split("_")[0] in ["light", "coffee", "4chan"] %} - + {% else %} - + {% endif %} {% elif p.domain in ['youtu.be','youtube.com'] and p.embed_url and p.embed_url.startswith(' Date: Thu, 9 Dec 2021 21:55:56 +0200 Subject: [PATCH 02/14] dfsdsf --- files/routes/comments.py | 1 + 1 file changed, 1 insertion(+) diff --git a/files/routes/comments.py b/files/routes/comments.py index fd0999802..aabf4c5eb 100644 --- a/files/routes/comments.py +++ b/files/routes/comments.py @@ -621,6 +621,7 @@ def edit_comment(cid, v): if c.is_banned or c.deleted_utc > 0: abort(403) body = request.values.get("body", "").strip()[:10000] + if len(body) < 1: return {"error":"You have to actually type something!"}, 400 if body != c.body and body != "": if v.marseyawarded: From a60b658a9001bf9a5b4a06cc3f313a4ef90111e8 Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:12:21 +0200 Subject: [PATCH 03/14] fdfsdsd --- .gitignore | 1 + files/helpers/const.py | 32 +++++++++++----------- files/helpers/sanitize.py | 4 +-- files/routes/awards.py | 35 +++++++++++++------------ files/templates/shop.html | 2 +- files/templates/submission.html | 17 +++++++++--- files/templates/submission_listing.html | 8 +++++- 7 files changed, 58 insertions(+), 41 deletions(-) diff --git a/.gitignore b/.gitignore index 1bded4b7b..5162f3b32 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ image.* chart.png video.mp4 +video.webm cache/ __pycache__/ disablesignups diff --git a/files/helpers/const.py b/files/helpers/const.py index 8156c2f4b..9a69eee7f 100644 --- a/files/helpers/const.py +++ b/files/helpers/const.py @@ -618,6 +618,14 @@ AWARDS = { "color": "text-silver", "price": 10000 }, + "unblockable": { + "kind": "unblockable", + "title": "Unblockable", + "description": "Makes the recipient unblockable and removes all blocks on them.", + "icon": "far fa-laugh-squint", + "color": "text-lightgreen", + "price": 10000 + }, "pause": { "kind": "pause", "title": "Pause", @@ -626,14 +634,6 @@ AWARDS = { "color": "text-danger", "price": 20000 }, - "unblockable": { - "kind": "unblockable", - "title": "Unblockable", - "description": "Makes the recipient unblockable and removes all blocks on them.", - "icon": "far fa-laugh-squint", - "color": "text-lightgreen", - "price": 25000 - }, "unpausable": { "kind": "unpausable", "title": "Unpausable", @@ -766,6 +766,14 @@ AWARDS2 = { "color": "text-silver", "price": 10000 }, + "unblockable": { + "kind": "unblockable", + "title": "Unblockable", + "description": "Makes the recipient unblockable and removes all blocks on them.", + "icon": "far fa-laugh-squint", + "color": "text-lightgreen", + "price": 10000 + }, "pause": { "kind": "pause", "title": "Pause", @@ -774,14 +782,6 @@ AWARDS2 = { "color": "text-danger", "price": 20000 }, - "unblockable": { - "kind": "unblockable", - "title": "Unblockable", - "description": "Makes the recipient unblockable and removes all blocks on them.", - "icon": "far fa-laugh-squint", - "color": "text-lightgreen", - "price": 25000 - }, "unpausable": { "kind": "unpausable", "title": "Unpausable", diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py index 8f1cc692f..b25a1e5ee 100644 --- a/files/helpers/sanitize.py +++ b/files/helpers/sanitize.py @@ -228,8 +228,8 @@ def sanitize(sanitized, noimages=False): htmlsource += '">' sanitized = sanitized.replace(replacing, htmlsource) - for i in re.finditer('

(https:.*?\.mp4)

', sanitized): - sanitized = sanitized.replace(i.group(0), f'

') + for i in re.finditer('

(https:.*?\.(mp4|webm))

', sanitized): + sanitized = sanitized.replace(i.group(0), f'

') for rd in ["https://reddit.com/", "https://new.reddit.com/", "https://www.reddit.com/", "https://redd.it/"]: sanitized = sanitized.replace(rd, "https://old.reddit.com/") diff --git a/files/routes/awards.py b/files/routes/awards.py index bc045936b..5d9bf980e 100644 --- a/files/routes/awards.py +++ b/files/routes/awards.py @@ -174,6 +174,15 @@ def shop(v): "owned": 0, "price": 10000 }, + "unblockable": { + "kind": "unblockable", + "title": "Unblockable", + "description": "Makes the recipient unblockable and removes all blocks on them.", + "icon": "far fa-laugh-squint", + "color": "text-lightgreen", + "owned": 0, + "price": 10000 + }, "pause": { "kind": "pause", "title": "Pause", @@ -183,15 +192,6 @@ def shop(v): "owned": 0, "price": 20000 }, - "unblockable": { - "kind": "unblockable", - "title": "Unblockable", - "description": "Makes the recipient unblockable and removes all blocks on them.", - "icon": "far fa-laugh-squint", - "color": "text-lightgreen", - "owned": 0, - "price": 25000 - }, "unpausable": { "kind": "unpausable", "title": "Unpausable", @@ -348,6 +348,14 @@ def buy(v, award): "color": "text-silver", "price": 10000 }, + "unblockable": { + "kind": "unblockable", + "title": "Unblockable", + "description": "Makes the recipient unblockable and removes all blocks on them.", + "icon": "far fa-laugh-squint", + "color": "text-lightgreen", + "price": 10000 + }, "pause": { "kind": "pause", "title": "Pause", @@ -356,14 +364,6 @@ def buy(v, award): "color": "text-danger", "price": 20000 }, - "unblockable": { - "kind": "unblockable", - "title": "Unblockable", - "description": "Makes the recipient unblockable and removes all blocks on them.", - "icon": "far fa-laugh-squint", - "color": "text-lightgreen", - "price": 25000 - }, "unpausable": { "kind": "unpausable", "title": "Unpausable", @@ -399,6 +399,7 @@ def buy(v, award): if request.values.get("mb"): if v.procoins < price: return {"error": "Not enough marseybux."}, 400 + if award in ["grass","alt"]: return {"error": "You can't buy those awards with marseybux."}, 403 v.procoins -= price else: if v.coins < price: return {"error": "Not enough coins."}, 400 diff --git a/files/templates/shop.html b/files/templates/shop.html index 24e777b6c..66afdf22f 100644 --- a/files/templates/shop.html +++ b/files/templates/shop.html @@ -64,7 +64,7 @@ {% set kind = a['kind'] %} Buy - {% if v.procoins and a['price'] < 3600 %}Buy with Marseybux{% endif %} + {% if v.procoins and a['kind'] not in ("grass","alt") %}Buy with Marseybux{% endif %} {% endfor %} diff --git a/files/templates/submission.html b/files/templates/submission.html index 9727e328b..3b4aaa3d2 100644 --- a/files/templates/submission.html +++ b/files/templates/submission.html @@ -123,7 +123,7 @@ -{% if p.url and p.url.lower().endswith('.mp4') %} +{% if p.url and (p.url.lower().endswith('.mp4') or p.url.lower().endswith('.webm')) %} {% endif %} @@ -152,7 +152,7 @@ {% if p.author %}{% endif %} -{% if p.url and p.url.lower().endswith('.mp4') %} +{% if p.url and (p.url.lower().endswith('.mp4') or p.url.lower().endswith('.webm')) %} {% endif %} @@ -402,7 +402,7 @@

{% if p.realurl(v) %} - {% if not p.embed_url and not p.is_image and not (p.url and p.url.lower().endswith('.mp4')) %} + {% if not p.embed_url and not p.is_image and not (p.url and (p.url.lower().endswith('.mp4') or p.url.lower().endswith('.webm'))) %}
{{p.domain|truncate(30, True)}} @@ -446,6 +446,15 @@

+							{% elif p.url and p.url.lower().endswith('.webm') %}
+								
+
+ +
+
+

 							{% endif %}
 							{{p.realbody(v) | safe}}
 
@@ -651,7 +660,7 @@
 
 		
 
-		{% if not p.is_image and not (p.url and p.url.lower().endswith('.mp4')) %}
+		{% if not p.is_image and not (p.url and (p.url.lower().endswith('.mp4') or p.url.lower().endswith('.webm'))) %}
 			
diff --git a/files/templates/submission_listing.html b/files/templates/submission_listing.html index 027e2c44a..1a11b4c85 100644 --- a/files/templates/submission_listing.html +++ b/files/templates/submission_listing.html @@ -148,7 +148,7 @@ - {% elif (p.url and p.url.lower().endswith('.mp4')) or (p.embed_url and "youtu" in p.domain) or (p.url and "streamable.com/e/" in p.url) %} + {% elif (p.url and (p.url.lower().endswith('.mp4') or p.url.lower().endswith('.webm'))) or (p.embed_url and "youtu" in p.domain) or (p.url and "streamable.com/e/" in p.url) %} @@ -491,6 +491,12 @@
+ {% elif p.url and p.url.lower().endswith('.webm') %} +
+ +
{% elif p.embed_url and p.domain in ['youtu.be','youtube.com'] and p.embed_url.startswith(' {{p.embed_url | safe}} From ab5dc9bfcd72d78fa967df53e2bea14dbe6eb800 Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:16:17 +0200 Subject: [PATCH 04/14] fsdfsd --- files/templates/default.html | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/files/templates/default.html b/files/templates/default.html index 91024e6f1..121c4564d 100644 --- a/files/templates/default.html +++ b/files/templates/default.html @@ -287,12 +287,16 @@ {% if v %} - + {% endif %} +{% if v %} +
{{v.formkey}}
+{% endif %} + \ No newline at end of file From ab38808c8cbf68f193629b6d6fd86b394a039324 Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:16:56 +0200 Subject: [PATCH 05/14] sfdfds --- files/templates/default.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/templates/default.html b/files/templates/default.html index 121c4564d..e9177d005 100644 --- a/files/templates/default.html +++ b/files/templates/default.html @@ -287,7 +287,7 @@ {% if v %} - + {% endif %} From 7b8dd3ce9ecf7f9c0fbeb05370714750fac2bf4b Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:18:07 +0200 Subject: [PATCH 06/14] fdssdf --- files/__main__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/__main__.py b/files/__main__.py index 5b02eac5f..5da10431d 100644 --- a/files/__main__.py +++ b/files/__main__.py @@ -125,7 +125,7 @@ def after_request(response): response.headers.add("Strict-Transport-Security", "max-age=31536000") response.headers.add("X-Frame-Options", "deny") - response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.pusher.com; object-src 'none';") + response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io; object-src 'none';") return response From 6f5e1afd0a85834967c0cdf918b1715322866d6e Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:18:34 +0200 Subject: [PATCH 07/14] dsfdsf --- files/__main__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/__main__.py b/files/__main__.py index 5da10431d..dec99ea7f 100644 --- a/files/__main__.py +++ b/files/__main__.py @@ -125,7 +125,7 @@ def after_request(response): response.headers.add("Strict-Transport-Security", "max-age=31536000") response.headers.add("X-Frame-Options", "deny") - response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io; object-src 'none';") + response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';") return response From e129375fb8b3d16242dcf3e23e45c72f7e6f7b59 Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:30:14 +0200 Subject: [PATCH 08/14] fdsfsd --- files/__main__.py | 1 - files/classes/comment.py | 4 +++- files/helpers/sanitize.py | 6 ++++++ files/templates/comments.html | 2 +- files/templates/submission.html | 8 ++++---- 5 files changed, 14 insertions(+), 7 deletions(-) diff --git a/files/__main__.py b/files/__main__.py index dec99ea7f..de8ff43f9 100644 --- a/files/__main__.py +++ b/files/__main__.py @@ -128,5 +128,4 @@ def after_request(response): response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';") return response - from files.routes import * \ No newline at end of file diff --git a/files/classes/comment.py b/files/classes/comment.py index 164a7b775..4478e9052 100644 --- a/files/classes/comment.py +++ b/files/classes/comment.py @@ -401,7 +401,9 @@ class Comment(Base): for o in self.options: html += f'
'
 		return html
diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py
index b25a1e5ee..ed8f2eac0 100644
--- a/files/helpers/sanitize.py
+++ b/files/helpers/sanitize.py
@@ -39,6 +39,9 @@ allowed_tags = tags = ['b',
 						'a',
 						'img',
 						'span',
+						'ruby',
+						'rp',
+						'rt',
 						]
 
 no_images = ['b',
@@ -71,6 +74,9 @@ no_images = ['b',
 						'marquee',
 						'a',
 						'span',
+						'ruby',
+						'rp',
+						'rt',
 						]
 
 def sanitize_marquee(tag, name, value):
diff --git a/files/templates/comments.html b/files/templates/comments.html
index ac5050d5b..edfb51e1b 100644
--- a/files/templates/comments.html
+++ b/files/templates/comments.html
@@ -761,7 +761,7 @@
 {% include "expanded_image_modal.html" %}
 
 
-
+
 
 
+									
 								{% else %}
-									
+									
 								{% endif %}
 							{% elif p.domain in ['youtu.be','youtube.com'] and p.embed_url and p.embed_url.startswith('								
-									
+									
 									
 								
{% endfor %} @@ -873,7 +873,7 @@ {% include "ban_modal.html" %} {% endif %} {% endif %} - + {% include "expanded_image_modal.html" %} {% endif %} From 489f116bb756757b1000a4c517d2091b75ae7868 Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Thu, 9 Dec 2021 22:35:37 +0200 Subject: [PATCH 09/14] fdssfd --- files/templates/submission.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/files/templates/submission.html b/files/templates/submission.html index 45dca3a83..e161bcfdb 100644 --- a/files/templates/submission.html +++ b/files/templates/submission.html @@ -417,9 +417,9 @@ {% if p.domain == "twitter.com" %} {{p.embed_url | safe}} {% if v and v.theme.split("_")[0] in ["light", "coffee", "4chan"] %} - + {% else %} - + {% endif %} {% elif p.domain in ['youtu.be','youtube.com'] and p.embed_url and p.embed_url.startswith(' Date: Thu, 9 Dec 2021 22:36:45 +0200 Subject: [PATCH 11/14] fsddsf --- files/templates/submission.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/files/templates/submission.html b/files/templates/submission.html index e161bcfdb..69862ce0d 100644 --- a/files/templates/submission.html +++ b/files/templates/submission.html @@ -417,9 +417,9 @@ {% if p.domain == "twitter.com" %} {{p.embed_url | safe}} {% if v and v.theme.split("_")[0] in ["light", "coffee", "4chan"] %} - + {% else %} - + {% endif %} {% elif p.domain in ['youtu.be','youtube.com'] and p.embed_url and p.embed_url.startswith(' Date: Thu, 9 Dec 2021 22:37:36 +0200 Subject: [PATCH 12/14] fsdfds --- files/templates/submission.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/files/templates/submission.html b/files/templates/submission.html index 69862ce0d..14301a7fb 100644 --- a/files/templates/submission.html +++ b/files/templates/submission.html @@ -417,9 +417,9 @@ {% if p.domain == "twitter.com" %} {{p.embed_url | safe}} {% if v and v.theme.split("_")[0] in ["light", "coffee", "4chan"] %} - + {% else %} - + {% endif %} {% elif p.domain in ['youtu.be','youtube.com'] and p.embed_url and p.embed_url.startswith(' Date: Thu, 9 Dec 2021 22:39:19 +0200 Subject: [PATCH 14/14] fsdfsdsdf --- files/templates/submission.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/files/templates/submission.html b/files/templates/submission.html index 14301a7fb..8cddfa366 100644 --- a/files/templates/submission.html +++ b/files/templates/submission.html @@ -417,9 +417,9 @@ {% if p.domain == "twitter.com" %} {{p.embed_url | safe}} {% if v and v.theme.split("_")[0] in ["light", "coffee", "4chan"] %} - + {% else %} - + {% endif %} {% elif p.domain in ['youtu.be','youtube.com'] and p.embed_url and p.embed_url.startswith('