From 38790232c20b74f57b459abe33f28cccba6b3dde Mon Sep 17 00:00:00 2001 From: Mawoka Date: Mon, 21 Nov 2022 17:15:06 +0100 Subject: [PATCH] :ambulance: Fixed allowed html-tags for custom formatting --- classquiz/config.py | 2 ++ classquiz/kahoot_importer/import_quiz.py | 8 ++++---- classquiz/routers/editor.py | 10 +++++----- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/classquiz/config.py b/classquiz/config.py index 2c28756..50757af 100644 --- a/classquiz/config.py +++ b/classquiz/config.py @@ -69,3 +69,5 @@ storage: Storage = Storage( ) meilisearch = MeiliSearch.Client(settings().meilisearch_url) + +ALLOWED_TAGS_FOR_QUIZ = ["b", "strong", "i", "em", "small", "mark", "del", "sub", "sup"] diff --git a/classquiz/kahoot_importer/import_quiz.py b/classquiz/kahoot_importer/import_quiz.py index 7044dc0..a8a55e8 100644 --- a/classquiz/kahoot_importer/import_quiz.py +++ b/classquiz/kahoot_importer/import_quiz.py @@ -10,7 +10,7 @@ from datetime import datetime import bleach from aiohttp import ClientSession -from classquiz.config import settings, storage, meilisearch +from classquiz.config import settings, storage, meilisearch, ALLOWED_TAGS_FOR_QUIZ from classquiz.db.models import Quiz, ABCDQuizAnswer, QuizQuestion, User from classquiz.kahoot_importer.get import get as get_quiz from classquiz.helpers import get_meili_data @@ -53,7 +53,7 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | str: quiz_questions.append( QuizQuestion( - question=html.unescape(bleach.clean(q.question, tags=bleach.ALLOWED_TAGS, strip=True)), + question=html.unescape(bleach.clean(q.question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)), answers=answers, time=str(q.time / 1000), image=image, @@ -68,8 +68,8 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | str: quiz_data = Quiz( id=quiz_id, public=True, - title=html.unescape(bleach.clean(quiz.kahoot.title, tags=bleach.ALLOWED_TAGS, strip=True)), - description=html.unescape(bleach.clean(quiz.kahoot.description, tags=bleach.ALLOWED_TAGS, strip=True)), + title=html.unescape(bleach.clean(quiz.kahoot.title, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)), + description=html.unescape(bleach.clean(quiz.kahoot.description, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)), created_at=datetime.now(), updated_at=datetime.now(), user_id=user.id, diff --git a/classquiz/routers/editor.py b/classquiz/routers/editor.py index deb6dc5..acdb6f6 100644 --- a/classquiz/routers/editor.py +++ b/classquiz/routers/editor.py @@ -13,7 +13,7 @@ import bleach from fastapi import APIRouter, File, UploadFile, HTTPException, Depends from pydantic import BaseModel -from classquiz.config import settings, redis, storage, meilisearch +from classquiz.config import settings, redis, storage, meilisearch, ALLOWED_TAGS_FOR_QUIZ from classquiz.db.models import Quiz, QuizInput, User, QuizQuestionType import puremagic from classquiz.auth import get_current_user @@ -121,8 +121,8 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput): if session_data is None: raise HTTPException(status_code=401, detail="Edit ID not found!") session_data = EditSessionData.parse_raw(session_data) - quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=bleach.ALLOWED_TAGS, strip=True)) - quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=bleach.ALLOWED_TAGS, strip=True)) + quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)) + quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)) if quiz_input.background_color is not None: quiz_input.background_color = html.unescape(bleach.clean(quiz_input.background_color, tags=[], strip=True)) @@ -137,7 +137,7 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput): quiz_input.questions[i].answers[i2].answer = None if answer.answer is not None: quiz_input.questions[i].answers[i2].answer = html.unescape( - bleach.clean(answer.answer, tags=bleach.ALLOWED_TAGS, strip=True) + bleach.clean(answer.answer, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True) ) image_id_regex = r"^.{36}--.{36}$" imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$" @@ -161,7 +161,7 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput): for i, question in enumerate(quiz_input.questions): image = question.image quiz_input.questions[i].question = html.unescape( - bleach.clean(quiz_input.questions[i].question, tags=bleach.ALLOWED_TAGS, strip=True) + bleach.clean(quiz_input.questions[i].question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True) ) if image == "": question.image = None