github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-01 08:49:03 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

DEV: Remove HTML setting type and sanitization logic. (#14440)

Browse Source 
* DEV: Remove HTML setting type and sanitization logic.

We concluded that we don't want settings to contain HTML, so I'm removing the setting type and sanitization logic. Additionally, we no longer allow the global-notice text to contain HTML.

I searched for usages of this setting type in the `all-the-plugins` repo and found none, so I haven't added a migration for existing settings.

* Mark Global notices containing links as HTML Safe.
This commit is contained in:
Roman Rizzi
2021-10-04 15:40:35 -03:00
committed by GitHub
parent 9f626f2735
commit 90a3fbc07b
10 changed files with 24 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/site_setting_extension.rb
View File

@ -212,16 +212,12 @@ module SiteSettingExtension
value = value.to_s if type == :upload
value = value.map(&:to_s).join("|") if type == :uploaded_image_list
if should_sanitize?(value, type)
value = sanitize(value)
end
[name, value]
end.flatten])
end
# Retrieve all settings
def all_settings(include_hidden: false, sanitize_plain_text_settings: false)
def all_settings(include_hidden: false)
locale_setting_hash =
{
@ -250,8 +246,6 @@ module SiteSettingExtension
default.to_i < Upload::SEEDED_ID_THRESHOLD
default = default_uploads[default.to_i]
elsif sanitize_plain_text_settings && should_sanitize?(value, type_hash[:type].to_s)
value = sanitize(value)
end
opts = {
@ -582,14 +576,6 @@ module SiteSettingExtension
end
end
def should_sanitize?(value, type)
value.is_a?(String) && type.to_s != 'html'
end
def sanitize(value)
CGI.unescapeHTML(Loofah.scrub_fragment(value, :strip).to_s)
end
def logger
Rails.logger
end