From 56ebef4352c9effd89c8e4b5737f2479bd0b0ae5 Mon Sep 17 00:00:00 2001 From: Samantaz Fox Date: Thu, 15 Jul 2021 23:01:36 +0200 Subject: [PATCH] Multiple front-end fixes (#2247) Fixes: * Sanitize user-provided content in HTML (Fixes #2193) * Fix encoding of search query in prev/next pages (Fixes #2229) * Fix some issues introduced with #2196: - Fix alignment of all

elements (Move the inline style from the parent to the

element) - Add missing comma on 'dir' HTML attribute (Typo introduced by PR #2196) Code cleaning: * Remove unnecessary 'each_sclice' + 'each' double loop in ECR files * Clean the player's list generation code (in player.ecr) --- src/invidious/comments.cr | 4 +- src/invidious/views/authorize_token.ecr | 8 +-- src/invidious/views/channel.ecr | 35 ++++++------- src/invidious/views/community.ecr | 11 ++-- src/invidious/views/components/item.ecr | 8 +-- src/invidious/views/components/player.ecr | 19 ++++--- src/invidious/views/edit_playlist.ecr | 16 +++--- src/invidious/views/history.ecr | 54 +++++++++----------- src/invidious/views/login.ecr | 4 +- src/invidious/views/mix.ecr | 16 +++--- src/invidious/views/playlist.ecr | 23 +++++---- src/invidious/views/playlists.ecr | 29 +++++------ src/invidious/views/popular.ecr | 8 ++- src/invidious/views/search.ecr | 16 +++--- src/invidious/views/subscription_manager.ecr | 10 ++-- src/invidious/views/subscriptions.ecr | 24 ++++----- src/invidious/views/trending.ecr | 8 ++- src/invidious/views/view_all_playlists.ecr | 16 +++--- src/invidious/views/watch.ecr | 21 ++++---- 19 files changed, 161 insertions(+), 169 deletions(-) diff --git a/src/invidious/comments.cr b/src/invidious/comments.cr index 81d6ac2bc..8877f52b1 100644 --- a/src/invidious/comments.cr +++ b/src/invidious/comments.cr @@ -312,6 +312,8 @@ def template_youtube_comments(comments, locale, thin_mode, is_replies = false) author_thumbnail = "" end + author_name = HTML.escape(child["author"].as_s) + html << <<-END_HTML
@@ -320,7 +322,7 @@ def template_youtube_comments(comments, locale, thin_mode, is_replies = false)

- #{child["author"]} + #{author_name}

#{child["contentHtml"]}

END_HTML diff --git a/src/invidious/views/authorize_token.ecr b/src/invidious/views/authorize_token.ecr index 8ea99010b..2dc948d96 100644 --- a/src/invidious/views/authorize_token.ecr +++ b/src/invidious/views/authorize_token.ecr @@ -9,13 +9,13 @@ <%= translate(locale, "Token") %>

-
-

+
+

<%= translate(locale, "Token manager") %>

-
-

+
+

<%= translate(locale, "Preferences") %>

diff --git a/src/invidious/views/channel.ecr b/src/invidious/views/channel.ecr index dd2807de0..09cfb76e2 100644 --- a/src/invidious/views/channel.ecr +++ b/src/invidious/views/channel.ecr @@ -1,6 +1,9 @@ +<% ucid = channel.ucid %> +<% author = HTML.escape(channel.author) %> + <% content_for "header" do %> -<%= channel.author %> - Invidious - +<%= author %> - Invidious + <% end %> <% if channel.banner %> @@ -17,12 +20,12 @@
- <%= channel.author %> + <%= author %>
-
+

- +

@@ -34,15 +37,13 @@

- <% ucid = channel.ucid %> - <% author = channel.author %> <% sub_count_text = number_to_short_text(channel.sub_count) %> <%= rendered "components/subscribe_widget" %>
- <%= translate(locale, "View channel on YouTube") %> + <%= translate(locale, "View channel on YouTube") %>
"><%= translate(locale, "Switch Invidious Instance") %>
@@ -55,12 +56,12 @@ <% if channel.auto_generated %> <%= translate(locale, "Playlists") %> <% else %> - <%= translate(locale, "Playlists") %> + <%= translate(locale, "Playlists") %> <% end %>
<% if channel.tabs.includes? "community" %> - <%= translate(locale, "Community") %> + <%= translate(locale, "Community") %> <% end %>
@@ -72,7 +73,7 @@ <% if sort_by == sort %> <%= translate(locale, sort) %> <% else %> - + <%= translate(locale, sort) %> <% end %> @@ -87,17 +88,15 @@

- <% items.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% items.each do |item| %> + <%= rendered "components/item" %> +<% end %>
<% if page > 1 %> - &sort_by=<%= HTML.escape(sort_by) %><% end %>"> + &sort_by=<%= HTML.escape(sort_by) %><% end %>"> <%= translate(locale, "Previous page") %> <% end %> @@ -105,7 +104,7 @@
<% if count == 60 %> - &sort_by=<%= HTML.escape(sort_by) %><% end %>"> + &sort_by=<%= HTML.escape(sort_by) %><% end %>"> <%= translate(locale, "Next page") %> <% end %> diff --git a/src/invidious/views/community.ecr b/src/invidious/views/community.ecr index 969762710..15d8ed1e0 100644 --- a/src/invidious/views/community.ecr +++ b/src/invidious/views/community.ecr @@ -1,5 +1,8 @@ +<% ucid = channel.ucid %> +<% author = HTML.escape(channel.author) %> + <% content_for "header" do %> -<%= channel.author %> - Invidious +<%= author %> - Invidious <% end %> <% if channel.banner %> @@ -16,7 +19,7 @@
- <%= channel.author %> + <%= author %>
@@ -33,8 +36,6 @@
- <% ucid = channel.ucid %> - <% author = channel.author %> <% sub_count_text = number_to_short_text(channel.sub_count) %> <%= rendered "components/subscribe_widget" %>
@@ -79,7 +80,7 @@
- <% watched.each_slice(4) do |slice| %> - <% slice.each do |item| %> -
-
- - <% if !env.get("preferences").as(Preferences).thin_mode %> -
- -
" method="post"> - "> -

- - - -

-
-
-

- <% end %> - -
-
- <% end %> + <% watched.each do |item| %> +
+
+ + <% if !env.get("preferences").as(Preferences).thin_mode %> +
+ +
" method="post"> + "> +

+ + + +

+
+
+

+ <% end %> + +
+
<% end %>
diff --git a/src/invidious/views/login.ecr b/src/invidious/views/login.ecr index b6e8117b9..1f6618e81 100644 --- a/src/invidious/views/login.ecr +++ b/src/invidious/views/login.ecr @@ -26,7 +26,7 @@
<% if email %> - + <% else %> "> @@ -62,7 +62,7 @@
<% if email %> - + <% else %> "> diff --git a/src/invidious/views/mix.ecr b/src/invidious/views/mix.ecr index e9c0dcbc1..e55b00f81 100644 --- a/src/invidious/views/mix.ecr +++ b/src/invidious/views/mix.ecr @@ -1,22 +1,20 @@ <% content_for "header" do %> -<%= mix.title %> - Invidious +<%= HTML.escape(mix.title) %> - Invidious <% end %>
-

<%= mix.title %>

+

<%= HTML.escape(mix.title) %>

-
-

+
+

- <% mix.videos.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% mix.videos.each do |item| %> + <%= rendered "components/item" %> +<% end %>
diff --git a/src/invidious/views/playlist.ecr b/src/invidious/views/playlist.ecr index 377da20f5..b1fee211d 100644 --- a/src/invidious/views/playlist.ecr +++ b/src/invidious/views/playlist.ecr @@ -1,17 +1,20 @@ +<% title = HTML.escape(playlist.title) %> +<% author = HTML.escape(playlist.author) %> + <% content_for "header" do %> -<%= playlist.title %> - Invidious +<%= title %> - Invidious <% end %>
-

<%= playlist.title %>

+

<%= title %>

<% if playlist.is_a? InvidiousPlaylist %> <% if playlist.author == user.try &.email %> - <%= playlist.author %> | + <%= author %> | <% else %> - <%= playlist.author %> | + <%= author %> | <% end %> <%= translate(locale, "`x` videos", "#{playlist.video_count}") %> | <%= translate(locale, "Updated `x` ago", recode_date(playlist.updated, locale)) %> | @@ -26,11 +29,12 @@ <% else %> - <%= playlist.author %> | + <%= author %> | <%= translate(locale, "`x` videos", "#{playlist.video_count}") %> | <%= translate(locale, "Updated `x` ago", recode_date(playlist.updated, locale)) %> <% end %> + <% if !playlist.is_a? InvidiousPlaylist %>
@@ -40,7 +44,6 @@ "> <%= translate(locale, "Switch Invidious Instance") %> -
<% end %>
@@ -93,11 +96,9 @@ <% end %>
- <% videos.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% videos.each do |item| %> + <%= rendered "components/item" %> +<% end %>
diff --git a/src/invidious/views/playlists.ecr b/src/invidious/views/playlists.ecr index 3f892650f..d9a17a9b7 100644 --- a/src/invidious/views/playlists.ecr +++ b/src/invidious/views/playlists.ecr @@ -1,5 +1,8 @@ +<% ucid = channel.ucid %> +<% author = HTML.escape(channel.author) %> + <% content_for "header" do %> -<%= channel.author %> - Invidious +<%= author %> - Invidious <% end %> <% if channel.banner %> @@ -16,12 +19,12 @@
- <%= channel.author %> + <%= author %>

- +

@@ -33,8 +36,6 @@
- <% ucid = channel.ucid %> - <% author = channel.author %> <% sub_count_text = number_to_short_text(channel.sub_count) %> <%= rendered "components/subscribe_widget" %>
@@ -42,7 +43,7 @@
- <%= translate(locale, "View channel on YouTube") %> + <%= translate(locale, "View channel on YouTube") %>
@@ -50,7 +51,7 @@
- <%= translate(locale, "Videos") %> + <%= translate(locale, "Videos") %>
<% if !channel.auto_generated %> @@ -59,7 +60,7 @@
<% if channel.tabs.includes? "community" %> - <%= translate(locale, "Community") %> + <%= translate(locale, "Community") %> <% end %>
@@ -71,7 +72,7 @@ <% if sort_by == sort %> <%= translate(locale, sort) %> <% else %> - + <%= translate(locale, sort) %> <% end %> @@ -86,18 +87,16 @@
- <% items.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% items.each do |item| %> + <%= rendered "components/item" %> +<% end %>
<% if continuation %> - &sort_by=<%= HTML.escape(sort_by) %><% end %>"> + &sort_by=<%= HTML.escape(sort_by) %><% end %>"> <%= translate(locale, "Next page") %> <% end %> diff --git a/src/invidious/views/popular.ecr b/src/invidious/views/popular.ecr index 62abb12af..e77f35b9c 100644 --- a/src/invidious/views/popular.ecr +++ b/src/invidious/views/popular.ecr @@ -12,9 +12,7 @@ <%= rendered "components/feed_menu" %>
- <% popular_videos.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% popular_videos.each do |item| %> + <%= rendered "components/item" %> +<% end %>
diff --git a/src/invidious/views/search.ecr b/src/invidious/views/search.ecr index 15389dce8..fd176e419 100644 --- a/src/invidious/views/search.ecr +++ b/src/invidious/views/search.ecr @@ -2,6 +2,8 @@ <%= search_query.not_nil!.size > 30 ? HTML.escape(query.not_nil![0,30].rstrip(".") + "...") : HTML.escape(query.not_nil!) %> - Invidious <% end %> +<% search_query_encoded = env.get?("search").try { |x| URI.encode(x.as(String), space_to_plus: true) } %> + <% if count == 0 %>

@@ -105,7 +107,7 @@
<% if page > 1 %> - + <%= translate(locale, "Previous page") %> <% end %> @@ -113,7 +115,7 @@
<% if count >= 20 %> - + <%= translate(locale, "Next page") %> <% end %> @@ -121,17 +123,15 @@
- <% videos.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> + <% videos.each do |item| %> + <%= rendered "components/item" %> <% end %>
<% if page > 1 %> - + <%= translate(locale, "Previous page") %> <% end %> @@ -139,7 +139,7 @@
<% if count >= 20 %> - + <%= translate(locale, "Next page") %> <% end %> diff --git a/src/invidious/views/subscription_manager.ecr b/src/invidious/views/subscription_manager.ecr index 6cddcd6c8..acf015f5e 100644 --- a/src/invidious/views/subscription_manager.ecr +++ b/src/invidious/views/subscription_manager.ecr @@ -10,15 +10,15 @@

-
-

+
+

<%= translate(locale, "Watch history") %>

-
-

+
+

<%= translate(locale, "Import/export") %> @@ -31,7 +31,7 @@

- <%= channel.author %> + <%= HTML.escape(channel.author) %>

diff --git a/src/invidious/views/subscriptions.ecr b/src/invidious/views/subscriptions.ecr index af1d4fbcc..97184e2bd 100644 --- a/src/invidious/views/subscriptions.ecr +++ b/src/invidious/views/subscriptions.ecr @@ -11,13 +11,13 @@ <%= translate(locale, "Manage subscriptions") %>

-
-

+
+

<%= translate(locale, "Watch history") %>

-
-

+
+

@@ -34,11 +34,9 @@ <% end %>
- <% notifications.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% notifications.each do |item| %> + <%= rendered "components/item" %> +<% end %>
@@ -55,11 +53,9 @@
- <% videos.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% videos.each do |item| %> + <%= rendered "components/item" %> +<% end %>
diff --git a/src/invidious/views/trending.ecr b/src/invidious/views/trending.ecr index 3ec62555d..a35c4ee3c 100644 --- a/src/invidious/views/trending.ecr +++ b/src/invidious/views/trending.ecr @@ -41,9 +41,7 @@
- <% trending.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% trending.each do |item| %> + <%= rendered "components/item" %> +<% end %>
diff --git a/src/invidious/views/view_all_playlists.ecr b/src/invidious/views/view_all_playlists.ecr index 5ec6aa317..868cfeda5 100644 --- a/src/invidious/views/view_all_playlists.ecr +++ b/src/invidious/views/view_all_playlists.ecr @@ -16,11 +16,9 @@
- <% items_created.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% items_created.each do |item| %> + <%= rendered "components/item" %> +<% end %>
@@ -30,9 +28,7 @@
- <% items_saved.each_slice(4) do |slice| %> - <% slice.each do |item| %> - <%= rendered "components/item" %> - <% end %> - <% end %> +<% items_saved.each do |item| %> + <%= rendered "components/item" %> +<% end %>
diff --git a/src/invidious/views/watch.ecr b/src/invidious/views/watch.ecr index c553dc0e6..aeb0f476e 100644 --- a/src/invidious/views/watch.ecr +++ b/src/invidious/views/watch.ecr @@ -1,10 +1,15 @@ +<% ucid = video.ucid %> +<% title = HTML.escape(video.title) %> +<% author = HTML.escape(video.author) %> + + <% content_for "header" do %> "> - + @@ -16,7 +21,7 @@ - + @@ -24,7 +29,7 @@ <%= rendered "components/player_sources" %> -<%= HTML.escape(video.title) %> - Invidious +<%= title %> - Invidious