commit ff8e400
Merge pull request 'XSS: Also encode in admin page, and other....' (#65) from yonle/snac2:master into master Reviewed-on: https://codeberg.org/grunfink/snac2/pulls/65
4 files changed,
+18,
-19
+0,
-1
1@@ -1154,7 +1154,6 @@ xs_dict *msg_question(snac *user, const char *content, xs_list *attach,
2 const xs_list *opts, int multiple, int end_secs)
3 /* creates a Question message */
4 {
5- xs *ntid = tid(0);
6 xs_dict *msg = msg_note(user, content, NULL, NULL, attach, 0);
7 int max = 8;
8 xs_set seen;
M
html.c
+9,
-9
1@@ -549,26 +549,26 @@ d_char *html_top_controls(snac *snac, d_char *s)
2
3 L("User setup..."),
4 snac->actor,
5- L("User name"),
6- xs_dict_get(snac->config, "name"),
7+ L("Display name"),
8+ encode_html(xs_dict_get(snac->config, "name")),
9 L("Avatar"),
10 L("Bio"),
11- xs_dict_get(snac->config, "bio"),
12+ encode_html(xs_dict_get(snac->config, "bio")),
13 strcmp(cw, "open") == 0 ? "checked" : "",
14 L("Always show sensitive content"),
15 L("Email address for notifications"),
16- email,
17+ encode_html(email),
18 L("Telegram notifications (bot key and chat id)"),
19- telegram_bot,
20- telegram_chat_id,
21+ encode_html(telegram_bot),
22+ encode_html(telegram_chat_id),
23 L("Maximum days to keep posts (0: server settings)"),
24- purge_days,
25+ encode_html(purge_days),
26 xs_type(d_dm_f_u) == XSTYPE_TRUE ? "checked" : "",
27 L("Drop direct messages from people you don't follow"),
28 xs_type(bot) == XSTYPE_TRUE ? "checked" : "",
29 L("This account is a bot"),
30- L("Password (only to change it)"),
31- L("Repeat Password"),
32+ L("New Password"),
33+ L("Repeat New Password"),
34 L("Update user info")
35 );
36
M
utils.c
+7,
-7
1@@ -85,7 +85,7 @@ int snac_init(const char *basedir)
2 FILE *f;
3
4 if (basedir == NULL) {
5- printf("Base directory:\n");
6+ printf("Base directory: ");
7 srv_basedir = xs_strip_i(xs_readline(stdin));
8 }
9 else
10@@ -98,7 +98,7 @@ int snac_init(const char *basedir)
11 srv_basedir = xs_crop_i(srv_basedir, 0, -1);
12
13 if (mtime(srv_basedir) != 0.0) {
14- printf("ERROR: directory '%s' must not exist\n", srv_basedir);
15+ printf("ERROR: directory '%s' must not exist.\n", srv_basedir);
16 return 1;
17 }
18
19@@ -107,14 +107,14 @@ int snac_init(const char *basedir)
20 xs *layout = xs_number_new(disk_layout);
21 srv_config = xs_dict_set(srv_config, "layout", layout);
22
23- printf("Network address [%s]:\n", xs_dict_get(srv_config, "address"));
24+ printf("Network address [%s]: ", xs_dict_get(srv_config, "address"));
25 {
26 xs *i = xs_strip_i(xs_readline(stdin));
27 if (*i)
28 srv_config = xs_dict_set(srv_config, "address", i);
29 }
30
31- printf("Network port [%d]:\n", (int)xs_number_get(xs_dict_get(srv_config, "port")));
32+ printf("Network port [%d]: ", (int)xs_number_get(xs_dict_get(srv_config, "port")));
33 {
34 xs *i = xs_strip_i(xs_readline(stdin));
35 if (*i) {
36@@ -123,7 +123,7 @@ int snac_init(const char *basedir)
37 }
38 }
39
40- printf("Host name:\n");
41+ printf("Host name: ");
42 {
43 xs *i = xs_strip_i(xs_readline(stdin));
44 if (*i == '\0')
45@@ -132,7 +132,7 @@ int snac_init(const char *basedir)
46 srv_config = xs_dict_set(srv_config, "host", i);
47 }
48
49- printf("URL prefix:\n");
50+ printf("URL prefix: ");
51 {
52 xs *i = xs_strip_i(xs_readline(stdin));
53
54@@ -144,7 +144,7 @@ int snac_init(const char *basedir)
55 }
56 }
57
58- printf("Admin email address (optional):\n");
59+ printf("Admin email address (optional): ");
60 {
61 xs *i = xs_strip_i(xs_readline(stdin));
62
+2,
-2
1@@ -30,8 +30,8 @@ struct _mime_info {
2 { "audio/mp3", ".mp3"},
3 { "audio/ogg", ".ogg"},
4 { "audio/ogg", ".oga"},
5- { "audio/opus", ".opus"},
6- { "audio/flac", ".flac"},
7+ { "audio/ogg", ".opus"},
8+ { "audio/flac", ".flac"},
9 { "audio/wav", ".wav"},
10 { "audio/wma", ".wma"},
11 { "audio/aac", ".aac"},