🐛 Fixed #42

classquiz/routers/quiz.py

@@ -13,6 +13,7 @@ from classquiz.auth import get_current_user
 from classquiz.config import redis, settings, storage, meilisearch
 from classquiz.db.models import Quiz, QuizInput, User, PlayGame
 from classquiz.kahoot_importer.import_quiz import import_quiz
+import html
 
 settings = settings()
 
@@ -23,8 +24,8 @@ router = APIRouter()
 async def create_quiz_lol(quiz_input: QuizInput, user: User = Depends(get_current_user)):
     imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$"
     server_regex = rf"^{settings.root_address}/api/v1/storage/download/.{36}--.{36}$"
-    quiz_input.title = bleach.clean(quiz_input.title, tags=[], strip=True)
-    quiz_input.description = bleach.clean(quiz_input.description, tags=[], strip=True)
+    quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=[], strip=True))
+    quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=[], strip=True))
     for question in quiz_input.questions:
         if question.image == "":
             question.image = None
@@ -132,8 +133,8 @@ async def update_quiz(quiz_id: str, quiz_input: QuizInput, user: User = Depends(
     if quiz is None:
         return JSONResponse(status_code=404, content={"detail": "quiz not found"})
     else:
-        quiz_input.description = bleach.clean(quiz_input.description, tags=[], strip=True)
-        quiz_input.title = bleach.clean(quiz_input.title, tags=[], strip=True)
+        quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=[], strip=True))
+        quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=[], strip=True))
         meilisearch.index(settings.meilisearch_index).update_documents([await get_meili_data(quiz)])
         if quiz.public and not quiz_input.public:
             meilisearch.index(settings.meilisearch_index).delete_document(str(quiz.id))

classquiz/routers/users.py

@@ -6,6 +6,7 @@ from datetime import timedelta, datetime
 from fastapi.background import BackgroundTasks
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.security import OAuth2PasswordRequestForm
+import html
 
 from classquiz.auth import (
     get_password_hash,
@@ -53,7 +54,7 @@ async def create_user(user: route_user, background_task: BackgroundTasks) -> Use
         raise HTTPException(status_code=409, detail="User already exists")
 
     user.password = get_password_hash(user.password)
-    user.username = bleach.clean(user.username, tags=[], strip=True)
+    user.username = html.unescape(bleach.clean(user.username, tags=[], strip=True))
     if len(user.username) == 32:
         return JSONResponse({"details": "Username mustn't be 32 characters long"}, 400)
     await user.save()