LobotomyLabs/classquiz-ai
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🚑 Fixed allowed html-tags for custom formatting

Browse Source
This commit is contained in:
Mawoka
2022-11-21 17:15:06 +01:00
parent 13f97abfa9
commit 38790232c2
3 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classquiz/config.py
+2
View File
@@ -69,3 +69,5 @@ storage: Storage = Storage(
) )
meilisearch = MeiliSearch.Client(settings().meilisearch_url) meilisearch = MeiliSearch.Client(settings().meilisearch_url)
ALLOWED_TAGS_FOR_QUIZ = ["b", "strong", "i", "em", "small", "mark", "del", "sub", "sup"]
classquiz/kahoot_importer/import_quiz.py
+4 -4
View File
@@ -10,7 +10,7 @@ from datetime import datetime
import bleach import bleach
from aiohttp import ClientSession from aiohttp import ClientSession
from classquiz.config import settings, storage, meilisearch from classquiz.config import settings, storage, meilisearch, ALLOWED_TAGS_FOR_QUIZ
from classquiz.db.models import Quiz, ABCDQuizAnswer, QuizQuestion, User from classquiz.db.models import Quiz, ABCDQuizAnswer, QuizQuestion, User
from classquiz.kahoot_importer.get import get as get_quiz from classquiz.kahoot_importer.get import get as get_quiz
from classquiz.helpers import get_meili_data from classquiz.helpers import get_meili_data
@@ -53,7 +53,7 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | str:
quiz_questions.append( quiz_questions.append(
QuizQuestion( QuizQuestion(
question=html.unescape(bleach.clean(q.question, tags=bleach.ALLOWED_TAGS, strip=True)), question=html.unescape(bleach.clean(q.question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)),
answers=answers, answers=answers,
time=str(q.time / 1000), time=str(q.time / 1000),
image=image, image=image,
@@ -68,8 +68,8 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | str:
quiz_data = Quiz( quiz_data = Quiz(
id=quiz_id, id=quiz_id,
public=True, public=True,
title=html.unescape(bleach.clean(quiz.kahoot.title, tags=bleach.ALLOWED_TAGS, strip=True)), title=html.unescape(bleach.clean(quiz.kahoot.title, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)),
description=html.unescape(bleach.clean(quiz.kahoot.description, tags=bleach.ALLOWED_TAGS, strip=True)), description=html.unescape(bleach.clean(quiz.kahoot.description, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)),
created_at=datetime.now(), created_at=datetime.now(),
updated_at=datetime.now(), updated_at=datetime.now(),
user_id=user.id, user_id=user.id,
classquiz/routers/editor.py
+5 -5
View File
@@ -13,7 +13,7 @@ import bleach
from fastapi import APIRouter, File, UploadFile, HTTPException, Depends from fastapi import APIRouter, File, UploadFile, HTTPException, Depends
from pydantic import BaseModel from pydantic import BaseModel
from classquiz.config import settings, redis, storage, meilisearch from classquiz.config import settings, redis, storage, meilisearch, ALLOWED_TAGS_FOR_QUIZ
from classquiz.db.models import Quiz, QuizInput, User, QuizQuestionType from classquiz.db.models import Quiz, QuizInput, User, QuizQuestionType
import puremagic import puremagic
from classquiz.auth import get_current_user from classquiz.auth import get_current_user
@@ -121,8 +121,8 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput):
if session_data is None: if session_data is None:
raise HTTPException(status_code=401, detail="Edit ID not found!") raise HTTPException(status_code=401, detail="Edit ID not found!")
session_data = EditSessionData.parse_raw(session_data) session_data = EditSessionData.parse_raw(session_data)
quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=bleach.ALLOWED_TAGS, strip=True)) quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True))
quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=bleach.ALLOWED_TAGS, strip=True)) quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True))
if quiz_input.background_color is not None: if quiz_input.background_color is not None:
quiz_input.background_color = html.unescape(bleach.clean(quiz_input.background_color, tags=[], strip=True)) quiz_input.background_color = html.unescape(bleach.clean(quiz_input.background_color, tags=[], strip=True))
@@ -137,7 +137,7 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput):
quiz_input.questions[i].answers[i2].answer = None quiz_input.questions[i].answers[i2].answer = None
if answer.answer is not None: if answer.answer is not None:
quiz_input.questions[i].answers[i2].answer = html.unescape( quiz_input.questions[i].answers[i2].answer = html.unescape(
bleach.clean(answer.answer, tags=bleach.ALLOWED_TAGS, strip=True) bleach.clean(answer.answer, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)
) )
image_id_regex = r"^.{36}--.{36}$" image_id_regex = r"^.{36}--.{36}$"
imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$" imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$"
@@ -161,7 +161,7 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput):
for i, question in enumerate(quiz_input.questions): for i, question in enumerate(quiz_input.questions):
image = question.image image = question.image
quiz_input.questions[i].question = html.unescape( quiz_input.questions[i].question = html.unescape(
bleach.clean(quiz_input.questions[i].question, tags=bleach.ALLOWED_TAGS, strip=True) bleach.clean(quiz_input.questions[i].question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)
) )
if image == "": if image == "":
question.image = None question.image = None