From 0a804f99beceea2f5c30865868b42fa3ceb90a07 Mon Sep 17 00:00:00 2001 From: Mawoka Date: Mon, 26 Sep 2022 18:34:21 +0200 Subject: [PATCH] :lock: Escaping background-color --- classquiz/routers/editor.py | 1 + 1 file changed, 1 insertion(+) diff --git a/classquiz/routers/editor.py b/classquiz/routers/editor.py index eb68d76..1553176 100644 --- a/classquiz/routers/editor.py +++ b/classquiz/routers/editor.py @@ -123,6 +123,7 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput): session_data = EditSessionData.parse_raw(session_data) quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=[], strip=True)) quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=[], strip=True)) + quiz_input.background_color = html.unescape(bleach.clean(quiz_input.background_color, tags=[], strip=True)) image_id_regex = r"^.{36}--.{36}$" imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$" server_regex = rf"^{re.escape(settings.root_address)}/api/v1/storage/download/.{{36}}--.{{36}}$"