From d45f77f2d0b4102e8d88eebd17337bc32cf4418f Mon Sep 17 00:00:00 2001 From: AnabolicsAnonymous Date: Sat, 18 Jan 2025 19:52:02 -0600 Subject: [PATCH 1/3] fix: remove htmlspecialchars from comment quote function --- resources/views/livewire/comment.blade.php | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/resources/views/livewire/comment.blade.php b/resources/views/livewire/comment.blade.php index d12e43684a..8604837a5a 100644 --- a/resources/views/livewire/comment.blade.php +++ b/resources/views/livewire/comment.blade.php @@ -28,11 +28,8 @@ class="post__quote" input = document.getElementById( '{{ $comment->isParent() ? 'new-comment__textarea' : 'reply-comment' }}' ); - input.value += - '[quote={{ \htmlspecialchars($comment->anon ? 'Anonymous' : '@' . $comment->user->username) }}]'; - input.value += decodeURIComponent( - escape(atob('{{ base64_encode(\htmlspecialchars($comment->content)) }}')) - ); + input.value += '[quote={{ $comment->anon ? 'Anonymous' : '@' . $comment->user->username }}]'; + input.value += decodeURIComponent(escape(atob('{{ base64_encode($comment->content) }}'))); input.value += '[/quote]'; input.dispatchEvent(new Event('input')); input.focus(); From edacc5f37a862527de7e8ec3688e39c7c8b62382 Mon Sep 17 00:00:00 2001 From: AnabolicsAnonymous Date: Mon, 20 Jan 2025 13:42:51 -0600 Subject: [PATCH 2/3] update: refractor post and description decoding logic --- resources/views/components/forum/post.blade.php | 11 +---------- .../views/torrent/partials/description.blade.php | 7 +------ 2 files changed, 2 insertions(+), 16 deletions(-) diff --git a/resources/views/components/forum/post.blade.php b/resources/views/components/forum/post.blade.php index 396e8240cb..2ba41cec22 100644 --- a/resources/views/components/forum/post.blade.php +++ b/resources/views/components/forum/post.blade.php @@ -110,16 +110,7 @@ class="post__quote" document.getElementById('forum_reply_form').style.display = 'block'; input = document.getElementById('bbcode-content'); input.value += '[quote={{ \htmlspecialchars('@' . $post->user->username) }}]'; - input.value += (() => { - var text = document.createElement('textarea'); - text.innerHTML = decodeURIComponent( - atob($refs.content.dataset.base64Bbcode) - .split('') - .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)) - .join('') - ); - return text.value; - })(); + input.value += decodeURIComponent(escape(atob('{{ base64_encode($post->content) }}'))); input.value += '[/quote]'; input.dispatchEvent(new Event('input')); input.focus(); diff --git a/resources/views/torrent/partials/description.blade.php b/resources/views/torrent/partials/description.blade.php index 1d43bfa6d9..3e28287437 100644 --- a/resources/views/torrent/partials/description.blade.php +++ b/resources/views/torrent/partials/description.blade.php @@ -24,12 +24,7 @@ class="form__button form__button--text" Alpine.data('description', () => ({ copy() { text = document.createElement('textarea'); - text.innerHTML = decodeURIComponent( - atob('{{ base64_encode($torrent->description) }}') - .split('') - .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)) - .join(''), - ); + text.innerHTML = decodeURIComponent(escape(atob('{{ base64_encode($torrent->description) }}'))); navigator.clipboard.writeText(text.value); Swal.fire({ toast: true, From b9d2a27f43aa0684a3275dcbfc12cf5dc1b5ce5e Mon Sep 17 00:00:00 2001 From: AnabolicsAnonymous Date: Mon, 20 Jan 2025 13:46:36 -0600 Subject: [PATCH 3/3] chore: prettier ci --- resources/views/torrent/partials/description.blade.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/resources/views/torrent/partials/description.blade.php b/resources/views/torrent/partials/description.blade.php index 3e28287437..6192b34b14 100644 --- a/resources/views/torrent/partials/description.blade.php +++ b/resources/views/torrent/partials/description.blade.php @@ -24,7 +24,9 @@ class="form__button form__button--text" Alpine.data('description', () => ({ copy() { text = document.createElement('textarea'); - text.innerHTML = decodeURIComponent(escape(atob('{{ base64_encode($torrent->description) }}'))); + text.innerHTML = decodeURIComponent( + escape(atob('{{ base64_encode($torrent->description) }}')), + ); navigator.clipboard.writeText(text.value); Swal.fire({ toast: true,