From 746416207bd15f7883af18e359b84f0c4444a12a Mon Sep 17 00:00:00 2001 From: rinpatch Date: Thu, 30 Jan 2020 19:55:01 +0300 Subject: Escape HTML from display name and subject fields Closes #724 --- src/services/entity_normalizer/entity_normalizer.service.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/services/entity_normalizer/entity_normalizer.service.js b/src/services/entity_normalizer/entity_normalizer.service.js index a3d0b782..3116d211 100644 --- a/src/services/entity_normalizer/entity_normalizer.service.js +++ b/src/services/entity_normalizer/entity_normalizer.service.js @@ -1,3 +1,5 @@ +import escape from 'escape-html' + const qvitterStatusType = (status) => { if (status.is_post_verb) { return 'status' @@ -41,7 +43,7 @@ export const parseUser = (data) => { } output.name = data.display_name - output.name_html = addEmojis(data.display_name, data.emojis) + output.name_html = addEmojis(escape(data.display_name), data.emojis) output.description = data.note output.description_html = addEmojis(data.note, data.emojis) @@ -256,7 +258,7 @@ export const parseStatus = (data) => { output.retweeted_status = parseStatus(data.reblog) } - output.summary_html = addEmojis(data.spoiler_text, data.emojis) + output.summary_html = addEmojis(escape(data.spoiler_text), data.emojis) output.external_url = data.url output.poll = data.poll output.pinned = data.pinned -- cgit v1.2.3-70-g09d2 From 9bbf10b55d97f6dbe3197ebbd1bb29d294ff6b55 Mon Sep 17 00:00:00 2001 From: kPherox Date: Tue, 4 Feb 2020 04:26:32 +0900 Subject: Add setting for allow_following_move --- src/components/user_settings/user_settings.js | 2 ++ src/components/user_settings/user_settings.vue | 9 ++++++--- src/services/entity_normalizer/entity_normalizer.service.js | 2 ++ 3 files changed, 10 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/components/user_settings/user_settings.js b/src/components/user_settings/user_settings.js index 38373056..eca6f9b1 100644 --- a/src/components/user_settings/user_settings.js +++ b/src/components/user_settings/user_settings.js @@ -55,6 +55,7 @@ const UserSettings = { showRole: this.$store.state.users.currentUser.show_role, role: this.$store.state.users.currentUser.role, discoverable: this.$store.state.users.currentUser.discoverable, + allowFollowingMove: this.$store.state.users.currentUser.allow_following_move, pickAvatarBtnVisible: true, bannerUploading: false, backgroundUploading: false, @@ -162,6 +163,7 @@ const UserSettings = { hide_follows: this.hideFollows, hide_followers: this.hideFollowers, discoverable: this.discoverable, + allow_following_move: this.allowFollowingMove, hide_follows_count: this.hideFollowsCount, hide_followers_count: this.hideFollowersCount, show_role: this.showRole diff --git a/src/components/user_settings/user_settings.vue b/src/components/user_settings/user_settings.vue index 2222c293..8b2336b4 100644 --- a/src/components/user_settings/user_settings.vue +++ b/src/components/user_settings/user_settings.vue @@ -90,9 +90,7 @@

- + {{ $t('settings.hide_followers_description') }}

@@ -104,6 +102,11 @@ {{ $t('settings.hide_followers_count_description') }}

+

+ + {{ $t('settings.allow_following_move') }} + +