Escape (some) channel names in frontend

This commit is contained in:
syeopite 2021-06-26 19:20:50 -07:00
parent 0a744d7cfa
commit e5063ef928
No known key found for this signature in database
GPG key ID: 6FA616E5A5294A82
5 changed files with 7 additions and 7 deletions

View file

@ -472,7 +472,7 @@ def template_reddit_comments(root, locale)
html << <<-END_HTML
<p>
<a href="javascript:void(0)" data-onclick="toggle_parent">[ - ]</a>
<b><a href="https://www.reddit.com/user/#{child.author}">#{child.author}</a></b>
<b><a href="https://www.reddit.com/user/#{child.author}">#{HTML.escape(child.author)}</a></b>
#{translate(locale, "`x` points", number_with_separator(child.score))}
<span title="#{child.created_utc.to_s(translate(locale, "%a %B %-d %T %Y UTC"))}">#{translate(locale, "`x` ago", recode_date(child.created_utc, locale))}</span>
<a href="https://www.reddit.com#{child.permalink}" title="#{translate(locale, "permalink")}">#{translate(locale, "permalink")}</a>

View file

@ -37,7 +37,7 @@
<% end %>
</a>
<div class="featured-channel-about">
<p class="featured-channel-title"><a href="/channel/<%= item.ucid %>"><%= item.author %></a></p>
<p class="featured-channel-title"><a href="/channel/<%= item.ucid %>"><%= HTML.escape(item.author) %></a></p>
<div class="featured-channel-metadata">
<p><%= translate(locale, "`x` subscribers", number_with_separator(item.subscriber_count)) %></p>
<p><%= translate(locale, "`x` videos", number_with_separator(item.video_count)) %></p>
@ -63,7 +63,7 @@
<% end %>
</a>
<div class="featured-channel-about">
<p class="featured-channel-title"><a href="/channel/<%= item.ucid %>"><%= item.author %></a></p>
<p class="featured-channel-title"><a href="/channel/<%= item.ucid %>"><%= HTML.escape(item.author) %></a></p>
<div class="featured-channel-metadata">
<span><%= translate(locale, "`x` subscribers", number_with_separator(item.subscriber_count)) %></span>
<span class="seperator"> | </span>

View file

@ -36,7 +36,7 @@
<div class="pure-u-2-3">
<div class="channel-profile">
<img src="/ggpht<%= URI.parse(channel.author_thumbnail).request_target %>">
<span><%= channel.author %></span>
<span><%= HTML.escape(channel.author) %></span>
</div>
</div>
<div class="pure-u-1-3" style="text-align:right">

View file

@ -14,7 +14,7 @@
<% if playlist.author == user.try &.email %>
<a href="/feed/playlists"><%= author %></a> |
<% else %>
<%= author %> |
<%= HTML.escape(playlist.author) %> |
<% end %>
<%= translate(locale, "`x` videos", "#{playlist.video_count}") %> |
<%= translate(locale, "Updated `x` ago", recode_date(playlist.updated, locale)) %> |
@ -29,7 +29,7 @@
</b>
<% else %>
<b>
<a href="/channel/<%= playlist.ucid %>"><%= author %></a> |
<a href="/channel/<%= playlist.ucid %>"><%= HTML.escape(playlist.author) %></a> |
<%= translate(locale, "`x` videos", "#{playlist.video_count}") %> |
<%= translate(locale, "`x` videos", "#{playlist.views}") %> |
<%= translate(locale, "Updated `x` ago", recode_date(playlist.updated, locale)) %>

View file

@ -233,7 +233,7 @@ we're going to need to do it here in order to allow for translations.
<% if !video.author_thumbnail.empty? %>
<img src="/ggpht<%= URI.parse(video.author_thumbnail).request_target %>">
<% end %>
<span id="channel-name"><%= author %></span>
<span id="channel-name"><%= HTML.escape(video.author) %></span>
</div>
</a>