diff --git a/files/__main__.py b/files/__main__.py
index 956d3c282..5cd9b3e68 100644
--- a/files/__main__.py
+++ b/files/__main__.py
@@ -136,8 +136,8 @@ def teardown_request(error):
def after_request(response):
response.headers.add("Strict-Transport-Security", "max-age=31536000")
- response.headers.add("Referrer-Policy", "same-origin")
response.headers.add("X-Frame-Options", "deny")
+ response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.pusher.com; object-src 'none';")
return response
diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py
index ead7cf741..ee09b768d 100644
--- a/files/helpers/sanitize.py
+++ b/files/helpers/sanitize.py
@@ -172,16 +172,16 @@ def sanitize(sanitized, noimages=False):
for i in re.finditer('(?', sanitized)
+ sanitized = re.sub(f'(?', sanitized)
if emoji in session["favorite_emojis"]: session["favorite_emojis"][emoji] += 1
else: session["favorite_emojis"][emoji] = 1
elif path.isfile(f'./files/assets/images/emojis/{emoji}.webp'):
- sanitized = re.sub(f'(?', sanitized)
+ sanitized = re.sub(f'(?', sanitized)
if emoji in session["favorite_emojis"]: session["favorite_emojis"][emoji] += 1
else: session["favorite_emojis"][emoji] = 1
@@ -229,7 +229,7 @@ def sanitize(sanitized, noimages=False):
sanitized = sanitized.replace(replacing, htmlsource)
for i in re.finditer('
(https:.*?\.mp4)
', sanitized):
- sanitized = sanitized.replace(i.group(0), f'
')
+ sanitized = sanitized.replace(i.group(0), f'
')
for rd in ["https://reddit.com/", "https://new.reddit.com/", "https://www.reddit.com/", "https://redd.it/"]:
sanitized = sanitized.replace(rd, "https://old.reddit.com/")
@@ -252,10 +252,10 @@ def filter_emojis_only(title):
if emoji.startswith("!"):
emoji = emoji[1:]
if path.isfile(f'./files/assets/images/emojis/{emoji}.webp'):
- title = re.sub(f'(?', title)
+ title = re.sub(f'(?', title)
elif path.isfile(f'./files/assets/images/emojis/{emoji}.webp'):
- title = re.sub(f'(?', title)
+ title = re.sub(f'(?', title)
if len(title) > 1500: abort(400)
else: return title
\ No newline at end of file
diff --git a/files/routes/posts.py b/files/routes/posts.py
index 99ebea693..522a3a182 100644
--- a/files/routes/posts.py
+++ b/files/routes/posts.py
@@ -114,7 +114,7 @@ def post_id(pid, anything=None, v=None):
post = get_post(pid, v=v)
- if post.club and not (v and (v.paid_dues or v.id == post.author_id)) or post.private and not (v and v.id == post.author_id): abort(403)
+ if not (v and v.admin_level > 1) and post.club and not (v and (v.paid_dues or v.id == post.author_id)) or post.private and not (v and v.id == post.author_id): abort(403)
if v:
votes = g.db.query(CommentVote).filter_by(user_id=v.id).subquery()
@@ -1070,7 +1070,7 @@ def submit_post(v):
if "rama" in request.host or "pcm" in request.host:
if v.id == CARP_ID:
if random.random() < 0.02: body = "i love you carp"
- else: body = "![](/assets/images/emojis/fuckoffcarp.webp)"
+ else: body = ":#marseyfuckoffcarp:"
elif v.id == LAWLZ_ID:
if random.random() < 0.5: body = "wow, this lawlzpost sucks!"
else: body = "wow, a good lawlzpost for once!"
diff --git a/files/templates/admin/image_posts.html b/files/templates/admin/image_posts.html
index 3c469e26a..3052d265a 100644
--- a/files/templates/admin/image_posts.html
+++ b/files/templates/admin/image_posts.html
@@ -11,27 +11,6 @@
{% block postNav %}{% endblock %}
{% block fixedMobileBarJS %}
-
{% endblock %}
{% block title %}
diff --git a/files/templates/admin/reported_posts.html b/files/templates/admin/reported_posts.html
index d0716b890..9439f78a0 100644
--- a/files/templates/admin/reported_posts.html
+++ b/files/templates/admin/reported_posts.html
@@ -39,27 +39,6 @@
{% block fixedMobileBarJS %}
-
{% endblock %}
{% block title %}
diff --git a/files/templates/authforms.html b/files/templates/authforms.html
index d46907db0..815dac53a 100644
--- a/files/templates/authforms.html
+++ b/files/templates/authforms.html
@@ -13,11 +13,11 @@
{% if v %}
-
+
{% if v.agendaposter %}{% elif v.css %}{% endif %}
{% else %}
-
+
{% endif %}
diff --git a/files/templates/ban_modal.html b/files/templates/ban_modal.html
index e34d3b338..a302603f7 100644
--- a/files/templates/ban_modal.html
+++ b/files/templates/ban_modal.html
@@ -1,28 +1,5 @@
-
+
@@ -83,22 +96,6 @@ On {{'SITE_NAME' | app_config}}, you can use Markdown formatting.
-
-
-
-
Block formatting
-
-These Markdown tags format an entire paragraph of text at a time.
-
-
-
-
-
Name
-
Type
-
Displays as
-
-
-
Blockquote
> text
@@ -122,12 +119,6 @@ These Markdown tags format an entire paragraph of text at a time.
Code Block
``` Use three backticks above and below. Or, indent the lines with four spaces. ```
-
-
-
-
Spoilers
-
<s> bussy > gussy </s>
-
bussy > gussy
Use three backticks above and below.
@@ -135,23 +126,11 @@ These Markdown tags format an entire paragraph of text at a time.
-
-
-
-
-
Custom Formatting
-
-We also have some custom hooks for mentioning users and subreddits. Note that these only work if the mentioned user or subreddit actually exists.
-
-
-
-
Name
-
Type
-
Displays as
+
Spoilers
+
<s> bussy > gussy </s>
+
bussy > gussy
-
-
Username Mention
@QuadNarca
@@ -170,21 +149,34 @@ We also have some custom hooks for mentioning users and subreddits. Note that th
-
Custom HTML
+
HTML Formatting
-And we allow custom HTML in most places.
+And we allow custom HTML in most places:
-Allowed tags:
+
+
+
+
+
Allowed Tags
Name
-
Type
-
Displays as
+
What you type
+
What gets displayed
+
+
Span
+
+ My mother has <span style="color:blue">blue</span> eyes.
+
+
+ My mother has blue eyes.
+
+
Bold
This will be <b>bold</b>
@@ -285,7 +277,6 @@ Text 2
Italics
<i>This</i> is how you get italics.
- This is how you get italics.
This is how you get italics.
@@ -457,19 +448,10 @@ line breaks
-
-
Span
-
- My mother has <span style="color:blue">blue</span> eyes.
-
-
- My mother has blue eyes.
-
-
-
Allowed Attributes
+
Allowed Attributes
@@ -511,7 +493,7 @@ line breaks
-
Allowed Styles
+
Allowed Styles
@@ -547,6 +529,9 @@ line breaks
overflow: auto;
}
}
+ pre {
+ color: var(--white) !important;
+ }
{% endblock %}
\ No newline at end of file
diff --git a/files/templates/header.html b/files/templates/header.html
index 9effe7303..912e2ed70 100644
--- a/files/templates/header.html
+++ b/files/templates/header.html
@@ -213,11 +213,6 @@
-{% if v %}
-
-{% endif %}
-
+
{% if v.agendaposter %}{% elif v.css %}{% endif %}
{% else %}
-
+
{% endif %}
@@ -122,14 +122,6 @@
-
-
-
+
{% endblock %}
\ No newline at end of file
diff --git a/files/templates/login_2fa.html b/files/templates/login_2fa.html
index 99059ed08..77768331b 100644
--- a/files/templates/login_2fa.html
+++ b/files/templates/login_2fa.html
@@ -12,7 +12,7 @@
2-Step Login - {{'SITE_NAME' | app_config}}
-
+
diff --git a/files/templates/settings2.html b/files/templates/settings2.html
index 360570ef9..6fc879a88 100644
--- a/files/templates/settings2.html
+++ b/files/templates/settings2.html
@@ -36,10 +36,10 @@
{% if v %}
-
+
{% else %}
-
+
{% endif %}
@@ -168,10 +168,6 @@
{% block scripts %}
{% endblock %}
-
-