From ac777ca5064c8544818da92648c9f24a33bfb3e0 Mon Sep 17 00:00:00 2001 From: Matthieu Bessat Date: Tue, 11 Aug 2020 12:06:33 +0200 Subject: [PATCH] fix: WTF is that twig.js? I'm dissapointed by you. It really html escaping disabled by default? I can't believe that --- src/controllers/PublicController.ts | 2 +- views/countdown.twig | 2 +- views/home.twig | 10 ++-- views/organization.twig | 72 ++++++++++++++--------------- 4 files changed, 43 insertions(+), 43 deletions(-) diff --git a/src/controllers/PublicController.ts b/src/controllers/PublicController.ts index 4e44def..9531756 100644 --- a/src/controllers/PublicController.ts +++ b/src/controllers/PublicController.ts @@ -51,7 +51,7 @@ export default class PublicController { return { _id: o._id, name: version.name, - description: version.descriptionShort.replace(/\n/g, ' ').replace(/\"/g, '\\"'), + description: version.descriptionShort.replace(/\n/g, ' '), thumbnail: version.thumbnail.key, tags: version.tags === null ? 'tags_not_found' : version.tags, slug: o.get('slugs')[o.get('slugs').length -1] diff --git a/views/countdown.twig b/views/countdown.twig index 74c5c3f..a747554 100644 --- a/views/countdown.twig +++ b/views/countdown.twig @@ -4,7 +4,7 @@ - + diff --git a/views/home.twig b/views/home.twig index af5e653..36f6ccc 100644 --- a/views/home.twig +++ b/views/home.twig @@ -3,8 +3,8 @@ {% block head %} - - + + {% endblock %} @@ -55,13 +55,13 @@
- {{ tag.name }} + {{ tag.name|escape('html') }}
+ {##} - - - + + + {% endblock %} {% block content %}
@@ -33,7 +33,7 @@

- {{ data.name }} + {{ data.name|escape('html') }}

{#

Sous titre @@ -85,7 +85,7 @@ {{ data.descriptionLong|raw }} {% elseif data.cutDescription %}
- {{ data.descriptionLong }} + {{ data.descriptionLong|raw }}
{% else %} - {{ data.descriptionShort }} + {{ data.descriptionShort|escape('html') }} {% endif %}

@@ -111,7 +111,7 @@
- {{ item.name }} {% if item.description is not empty %}- {{ item.description }}{% endif %} + {{ item.name|escape('html') }} {% if item.description is not empty %}- {{ item.description|escape('html') }}{% endif %}
- {{ when.day }} + {{ when.day|escape('html') }}
{% for i in when.hours %} - {{ i.from }} - {{ i.to }}{% if not loop.last %},{% endif %} + {{ i.from|escape('html') }} - {{ i.to|escape('html') }}{% if not loop.last %},{% endif %} {% endfor %}
@@ -163,13 +163,13 @@ {% for item in data.pricing %}
- {{ item.priceLabel }} + {{ item.priceLabel|escape('html') }}
- {{ item.name }} + {{ item.name|escape('html') }}
- {{ item.description }} + {{ item.description|escape('html') }}
{% endfor %} @@ -188,7 +188,7 @@
- {{ data.contacts.person }} + {{ data.contacts.person|escape('html') }}
Responsable @@ -199,8 +199,8 @@ - - {{ data.contacts.email }} + + {{ data.contacts.email|escape('html') }}
{% if data.contacts.phoneInt is not empty %} @@ -208,8 +208,8 @@ - - {{ data.contacts.phoneSplit }} + + {{ data.contacts.phoneSplit|escape('html') }}
{% endif %} @@ -219,10 +219,10 @@
- {{ people.name }} + {{ people.name|escape('html') }}
- {{ people.role }} + {{ people.role|escape('html') }}
@@ -230,16 +230,16 @@ - - {{ people.email }} + + {{ people.email|escape('html') }}
- - {{ people.phoneSplit }} + + {{ people.phoneSplit|escape('html') }}
@@ -293,7 +293,7 @@
{% for line in data.contacts.address %} -
{{ line }}
+
{{ line|escape('html') }}
{% endfor %}
@@ -306,8 +306,8 @@
- - {{ data.contacts.website }} + + {{ data.contacts.website|escape('html') }} @@ -323,12 +323,12 @@
- + - {{ data.contacts.facebookLabel }} + {{ data.contacts.facebookLabel|escape('html') }} - {{ data.contacts.facebook }} + {{ data.contacts.facebook|escape('html') }}
- + - {{ data.contacts.instagramLabel }} + {{ data.contacts.instagramLabel|escape('html') }} - {{ data.contacts.instagram }} + {{ data.contacts.instagram|escape('html') }}
- + - {{ data.contacts.twitterLabel }} + {{ data.contacts.twitterLabel|escape('html') }} - {{ data.contacts.twitter }} + {{ data.contacts.twitter|escape('html') }}