diff --git a/files/__main__.py b/files/__main__.py index 956d3c282..5cd9b3e68 100644 --- a/files/__main__.py +++ b/files/__main__.py @@ -136,8 +136,8 @@ def teardown_request(error): def after_request(response): response.headers.add("Strict-Transport-Security", "max-age=31536000") - response.headers.add("Referrer-Policy", "same-origin") response.headers.add("X-Frame-Options", "deny") + response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.pusher.com; object-src 'none';") return response diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py index ead7cf741..ee09b768d 100644 --- a/files/helpers/sanitize.py +++ b/files/helpers/sanitize.py @@ -172,16 +172,16 @@ def sanitize(sanitized, noimages=False): for i in re.finditer('(?', sanitized) + sanitized = re.sub(f'(?', sanitized) if emoji in session["favorite_emojis"]: session["favorite_emojis"][emoji] += 1 else: session["favorite_emojis"][emoji] = 1 elif path.isfile(f'./files/assets/images/emojis/{emoji}.webp'): - sanitized = re.sub(f'(?', sanitized) + sanitized = re.sub(f'(?', sanitized) if emoji in session["favorite_emojis"]: session["favorite_emojis"][emoji] += 1 else: session["favorite_emojis"][emoji] = 1 @@ -229,7 +229,7 @@ def sanitize(sanitized, noimages=False): sanitized = sanitized.replace(replacing, htmlsource) for i in re.finditer('

(https:.*?\.mp4)

', sanitized): - sanitized = sanitized.replace(i.group(0), f'

') + sanitized = sanitized.replace(i.group(0), f'

') for rd in ["https://reddit.com/", "https://new.reddit.com/", "https://www.reddit.com/", "https://redd.it/"]: sanitized = sanitized.replace(rd, "https://old.reddit.com/") @@ -252,10 +252,10 @@ def filter_emojis_only(title): if emoji.startswith("!"): emoji = emoji[1:] if path.isfile(f'./files/assets/images/emojis/{emoji}.webp'): - title = re.sub(f'(?', title) + title = re.sub(f'(?', title) elif path.isfile(f'./files/assets/images/emojis/{emoji}.webp'): - title = re.sub(f'(?', title) + title = re.sub(f'(?', title) if len(title) > 1500: abort(400) else: return title \ No newline at end of file diff --git a/files/routes/posts.py b/files/routes/posts.py index 99ebea693..522a3a182 100644 --- a/files/routes/posts.py +++ b/files/routes/posts.py @@ -114,7 +114,7 @@ def post_id(pid, anything=None, v=None): post = get_post(pid, v=v) - if post.club and not (v and (v.paid_dues or v.id == post.author_id)) or post.private and not (v and v.id == post.author_id): abort(403) + if not (v and v.admin_level > 1) and post.club and not (v and (v.paid_dues or v.id == post.author_id)) or post.private and not (v and v.id == post.author_id): abort(403) if v: votes = g.db.query(CommentVote).filter_by(user_id=v.id).subquery() @@ -1070,7 +1070,7 @@ def submit_post(v): if "rama" in request.host or "pcm" in request.host: if v.id == CARP_ID: if random.random() < 0.02: body = "i love you carp" - else: body = "![](/assets/images/emojis/fuckoffcarp.webp)" + else: body = ":#marseyfuckoffcarp:" elif v.id == LAWLZ_ID: if random.random() < 0.5: body = "wow, this lawlzpost sucks!" else: body = "wow, a good lawlzpost for once!" diff --git a/files/templates/admin/image_posts.html b/files/templates/admin/image_posts.html index 3c469e26a..3052d265a 100644 --- a/files/templates/admin/image_posts.html +++ b/files/templates/admin/image_posts.html @@ -11,27 +11,6 @@ {% block postNav %}{% endblock %} {% block fixedMobileBarJS %} - {% endblock %} {% block title %} diff --git a/files/templates/admin/reported_posts.html b/files/templates/admin/reported_posts.html index d0716b890..9439f78a0 100644 --- a/files/templates/admin/reported_posts.html +++ b/files/templates/admin/reported_posts.html @@ -39,27 +39,6 @@ {% block fixedMobileBarJS %} - {% endblock %} {% block title %} diff --git a/files/templates/authforms.html b/files/templates/authforms.html index d46907db0..815dac53a 100644 --- a/files/templates/authforms.html +++ b/files/templates/authforms.html @@ -13,11 +13,11 @@ {% if v %} - + {% if v.agendaposter %}{% elif v.css %}{% endif %} {% else %} - + {% endif %} diff --git a/files/templates/ban_modal.html b/files/templates/ban_modal.html index e34d3b338..a302603f7 100644 --- a/files/templates/ban_modal.html +++ b/files/templates/ban_modal.html @@ -1,28 +1,5 @@ - +