From e35e6b0f450e3a947a41e491d5c1765e521e0244 Mon Sep 17 00:00:00 2001 From: Wim Brand Date: Mon, 7 Dec 2020 22:23:29 +0100 Subject: [PATCH] fix XSS on opengraph tags --- res/include/md/subscribe.md | 2 +- res/template/file_viewer.html | 26 +++-- res/template/file_viewer_compat.html | 2 +- res/template/filesystem_svelte.html | 2 +- res/template/fragments/opengraph.html | 13 +++ webcontroller/file_viewer.go | 9 +- webcontroller/opengraph.go | 136 ++++++++++++-------------- webcontroller/templates.go | 2 +- 8 files changed, 95 insertions(+), 97 deletions(-) create mode 100644 res/template/fragments/opengraph.html diff --git a/res/include/md/subscribe.md b/res/include/md/subscribe.md index e106f34..4989538 100644 --- a/res/include/md/subscribe.md +++ b/res/include/md/subscribe.md @@ -65,4 +65,4 @@ See our subscription plans on Patreon After ordering you will receive an e-mail with a link to activate your subscription. The subscription will be linked to the pixeldrain account you're -currently loggin into. +currently logged into. diff --git a/res/template/file_viewer.html b/res/template/file_viewer.html index dac0d75..1cbc15b 100644 --- a/res/template/file_viewer.html +++ b/res/template/file_viewer.html @@ -24,7 +24,7 @@ {{template `modal.css`}} - {{.OGData}} + {{ template "opengraph" .OGData }} @@ -81,19 +81,17 @@ {{ if and .Other.FileAdsEnabled .Other.UserAdsEnabled }}
-
- - -
- - Put your own advertisement here - -
+ Tired of ads?
+ Files expiring too soon?
+ + + + + + + + Become a Patron! + {{ end }} diff --git a/res/template/file_viewer_compat.html b/res/template/file_viewer_compat.html index 46b392e..da15a6b 100644 --- a/res/template/file_viewer_compat.html +++ b/res/template/file_viewer_compat.html @@ -23,7 +23,7 @@ {{template `viewer.css`}} - {{.OGData}} + {{ template "opengraph" .OGData }} diff --git a/res/template/filesystem_svelte.html b/res/template/filesystem_svelte.html index e705237..37a7808 100644 --- a/res/template/filesystem_svelte.html +++ b/res/template/filesystem_svelte.html @@ -19,7 +19,7 @@ - {{.OGData}} + {{ template "opengraph" .OGData }}