From 88cc3addcddad692c71d09d10224736a198eb658 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Sat, 13 Aug 2022 22:58:32 +0100 Subject: [PATCH] Add Ambiguous Character Detection to Description, FullName and others Users can change their description, full-names and others to include ambiguous and invisible characters which may lead to misleading information. This PR adds ambiguous/invisible character detection to these fields. Signed-off-by: Andrew Thornton --- modules/charset/escape.go | 26 +++-- modules/charset/escape_test.go | 2 +- modules/templates/helper.go | 102 +++++++++++++++--- options/locale/locale_en-US.ini | 3 + routers/web/feed/convert.go | 2 +- routers/web/repo/lfs.go | 2 +- routers/web/repo/view.go | 8 +- routers/web/repo/wiki.go | 2 +- templates/admin/emails/list.tmpl | 6 +- templates/admin/user/list.tmpl | 4 +- templates/base/head_script.tmpl | 5 +- templates/explore/organizations.tmpl | 2 +- templates/explore/users.tmpl | 8 +- templates/org/home.tmpl | 6 +- templates/repo/branch/list.tmpl | 4 +- templates/repo/commit_page.tmpl | 30 +++--- templates/repo/commits_list.tmpl | 10 +- templates/repo/commits_list_small.tmpl | 6 +- templates/repo/diff/compare.tmpl | 2 +- templates/repo/graph/commits.tmpl | 8 +- templates/repo/issue/view_title.tmpl | 2 +- templates/repo/settings/protected_branch.tmpl | 2 +- templates/repo/settings/tags.tmpl | 2 +- templates/repo/view_list.tmpl | 16 +-- templates/user/auth/activate.tmpl | 8 +- templates/user/auth/forgot_passwd.tmpl | 4 +- templates/user/dashboard/feeds.tmpl | 2 +- templates/user/profile.tmpl | 12 +-- templates/user/settings/account.tmpl | 4 +- templates/user/settings/keys_gpg.tmpl | 4 +- templates/user/settings/profile.tmpl | 4 +- web_src/js/features/repo-unicode-escape.js | 28 +++-- web_src/js/features/tribute.js | 4 +- web_src/less/_base.less | 32 +++++- web_src/less/_repository.less | 22 ---- web_src/less/_review.less | 7 -- 36 files changed, 247 insertions(+), 144 deletions(-) diff --git a/modules/charset/escape.go b/modules/charset/escape.go index b264a569ff5ed..d92a34ed29fa7 100644 --- a/modules/charset/escape.go +++ b/modules/charset/escape.go @@ -22,18 +22,12 @@ const RuneNBSP = 0xa0 // EscapeControlHTML escapes the unicode control sequences in a provided html document func EscapeControlHTML(text string, locale translation.Locale, allowed ...rune) (escaped *EscapeStatus, output string) { sb := &strings.Builder{} - outputStream := &HTMLStreamerWriter{Writer: sb} - streamer := NewEscapeStreamer(locale, outputStream, allowed...).(*escapeStreamer) - - if err := StreamHTML(strings.NewReader(text), streamer); err != nil { - streamer.escaped.HasError = true - log.Error("Error whilst escaping: %v", err) - } - return streamer.escaped, sb.String() + escaped, _ = EscapeControlHTMLReader(strings.NewReader(text), sb, locale, allowed...) + return escaped, sb.String() } -// EscapeControlReaders escapes the unicode control sequences in a provider reader and writer in a locale and returns the findings as an EscapeStatus and the escaped []byte -func EscapeControlReader(reader io.Reader, writer io.Writer, locale translation.Locale, allowed ...rune) (escaped *EscapeStatus, err error) { +// EscapeControlHTMLReader escapes the unicode control sequences in a provided reader of an HTML document and writer in a locale and returns the findings as an EscapeStatus +func EscapeControlHTMLReader(reader io.Reader, writer io.Writer, locale translation.Locale, allowed ...rune) (escaped *EscapeStatus, err error) { outputStream := &HTMLStreamerWriter{Writer: writer} streamer := NewEscapeStreamer(locale, outputStream, allowed...).(*escapeStreamer) @@ -56,3 +50,15 @@ func EscapeControlString(text string, locale translation.Locale, allowed ...rune } return streamer.escaped, sb.String() } + +// EscapeControlStringWriter escapes the unicode control sequences in a string and provided writer in a locale and returns the findings as an EscapeStatus +func EscapeControlStringWriter(text string, writer io.Writer, locale translation.Locale, allowed ...rune) (escaped *EscapeStatus, err error) { + outputStream := &HTMLStreamerWriter{Writer: writer} + streamer := NewEscapeStreamer(locale, outputStream, allowed...).(*escapeStreamer) + + if err = streamer.Text(text); err != nil { + streamer.escaped.HasError = true + log.Error("Error whilst escaping: %v", err) + } + return streamer.escaped, err +} diff --git a/modules/charset/escape_test.go b/modules/charset/escape_test.go index 8063e115424cb..0a84416fd6e70 100644 --- a/modules/charset/escape_test.go +++ b/modules/charset/escape_test.go @@ -173,7 +173,7 @@ func TestEscapeControlReader(t *testing.T) { t.Run(tt.name, func(t *testing.T) { input := strings.NewReader(tt.text) output := &strings.Builder{} - status, err := EscapeControlReader(input, output, translation.NewLocale("en_US")) + status, err := EscapeControlHTMLReader(input, output, translation.NewLocale("en_US")) result := output.String() if err != nil { t.Errorf("EscapeControlReader(): err = %v", err) diff --git a/modules/templates/helper.go b/modules/templates/helper.go index 602afec4135fc..7b065eb3bcdfe 100644 --- a/modules/templates/helper.go +++ b/modules/templates/helper.go @@ -31,6 +31,7 @@ import ( repo_model "code.gitea.io/gitea/models/repo" user_model "code.gitea.io/gitea/models/user" "code.gitea.io/gitea/modules/base" + "code.gitea.io/gitea/modules/charset" "code.gitea.io/gitea/modules/emoji" "code.gitea.io/gitea/modules/git" giturl "code.gitea.io/gitea/modules/git/url" @@ -42,6 +43,7 @@ import ( "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/svg" "code.gitea.io/gitea/modules/timeutil" + "code.gitea.io/gitea/modules/translation" "code.gitea.io/gitea/modules/util" "code.gitea.io/gitea/services/gitdiff" @@ -343,12 +345,15 @@ func NewFuncMap() []template.FuncMap { } return false }, - "svg": SVG, - "avatar": Avatar, - "avatarHTML": AvatarHTML, - "avatarByAction": AvatarByAction, - "avatarByEmail": AvatarByEmail, - "repoAvatar": RepoAvatar, + "svg": SVG, + "avatar": Avatar, + "avatarHTML": AvatarHTML, + "avatarByAction": AvatarByAction, + "avatarByEmail": AvatarByEmail, + "escapeAmbiguous": EscapeAmbiguous, + "escapeAmbiguousHTML": EscapeAmbiguousHTML, + "escapeAmbiguousLink": EscapeAmbiguousLink, + "repoAvatar": RepoAvatar, "SortArrow": func(normSort, revSort, urlSort string, isDefault bool) template.HTML { // if needed if len(normSort) == 0 || len(urlSort) == 0 { @@ -680,6 +685,67 @@ func AvatarByEmail(email, name string, others ...interface{}) template.HTML { return template.HTML("") } +// EscapeAmbiguous +func EscapeAmbiguous(locale translation.Locale, text string) template.HTML { + sb := &strings.Builder{} + status, _ := charset.EscapeControlStringWriter(text, sb, locale) + escapeStatusSwitch(locale, sb, status) + + return template.HTML(sb.String()) +} + +// EscapeAmbiguousHTML +func EscapeAmbiguousHTML(locale translation.Locale, html string) template.HTML { + sb := &strings.Builder{} + status, _ := charset.EscapeControlHTMLReader(strings.NewReader(html), sb, locale) + escapeStatusSwitch(locale, sb, status) + return template.HTML(sb.String()) +} + +// EscapeAmbiguousLink takes a locale, text body - which is assumed to be a string not html, href and other attributes +func EscapeAmbiguousLink(locale translation.Locale, text, href string, attrs ...string) template.HTML { + sb := &strings.Builder{} + _, _ = sb.WriteString(``) + status, _ := charset.EscapeControlStringWriter(text, sb, locale) + _, _ = sb.WriteString(``) + + escapeStatusSwitch(locale, sb, status) + return template.HTML(sb.String()) +} + +func escapeStatusSwitch(locale translation.Locale, sb *strings.Builder, status *charset.EscapeStatus) { + if status.Escaped { + _, _ = sb.WriteString(``) + } +} + // Safe render raw as HTML func Safe(raw string) template.HTML { return template.HTML(raw) @@ -711,13 +777,13 @@ func DotEscape(raw string) string { } // RenderCommitMessage renders commit message with XSS-safe and special links. -func RenderCommitMessage(ctx context.Context, msg, urlPrefix string, metas map[string]string) template.HTML { - return RenderCommitMessageLink(ctx, msg, urlPrefix, "", metas) +func RenderCommitMessage(ctx context.Context, locale translation.Locale, msg, urlPrefix string, metas map[string]string) template.HTML { + return RenderCommitMessageLink(ctx, locale, msg, urlPrefix, "", metas) } // RenderCommitMessageLink renders commit message as a XXS-safe link to the provided // default url, handling for special links. -func RenderCommitMessageLink(ctx context.Context, msg, urlPrefix, urlDefault string, metas map[string]string) template.HTML { +func RenderCommitMessageLink(ctx context.Context, locale translation.Locale, msg, urlPrefix, urlDefault string, metas map[string]string) template.HTML { cleanMsg := template.HTMLEscapeString(msg) // we can safely assume that it will not return any error, since there // shouldn't be any special HTML. @@ -731,16 +797,17 @@ func RenderCommitMessageLink(ctx context.Context, msg, urlPrefix, urlDefault str log.Error("RenderCommitMessage: %v", err) return "" } - msgLines := strings.Split(strings.TrimSpace(fullMessage), "\n") + msgLines := strings.SplitN(strings.TrimSpace(fullMessage), "\n", 2) if len(msgLines) == 0 { return template.HTML("") } - return template.HTML(msgLines[0]) + _, renderedMessage := charset.EscapeControlHTML(msgLines[0], locale) + return template.HTML(renderedMessage) } // RenderCommitMessageLinkSubject renders commit message as a XXS-safe link to // the provided default url, handling for special links without email to links. -func RenderCommitMessageLinkSubject(ctx context.Context, msg, urlPrefix, urlDefault string, metas map[string]string) template.HTML { +func RenderCommitMessageLinkSubject(ctx context.Context, locale translation.Locale, msg, urlPrefix, urlDefault string, metas map[string]string) template.HTML { msgLine := strings.TrimLeftFunc(msg, unicode.IsSpace) lineEnd := strings.IndexByte(msgLine, '\n') if lineEnd > 0 { @@ -763,11 +830,12 @@ func RenderCommitMessageLinkSubject(ctx context.Context, msg, urlPrefix, urlDefa log.Error("RenderCommitMessageSubject: %v", err) return template.HTML("") } + _, renderedMessage = charset.EscapeControlHTML(renderedMessage, locale) return template.HTML(renderedMessage) } // RenderCommitBody extracts the body of a commit message without its title. -func RenderCommitBody(ctx context.Context, msg, urlPrefix string, metas map[string]string) template.HTML { +func RenderCommitBody(ctx context.Context, locale translation.Locale, msg, urlPrefix string, metas map[string]string) template.HTML { msgLine := strings.TrimRightFunc(msg, unicode.IsSpace) lineEnd := strings.IndexByte(msgLine, '\n') if lineEnd > 0 { @@ -789,11 +857,12 @@ func RenderCommitBody(ctx context.Context, msg, urlPrefix string, metas map[stri log.Error("RenderCommitMessage: %v", err) return "" } + _, renderedMessage = charset.EscapeControlHTML(renderedMessage, locale) return template.HTML(renderedMessage) } // RenderIssueTitle renders issue/pull title with defined post processors -func RenderIssueTitle(ctx context.Context, text, urlPrefix string, metas map[string]string) template.HTML { +func RenderIssueTitle(ctx context.Context, locale translation.Locale, text, urlPrefix string, metas map[string]string) template.HTML { renderedText, err := markup.RenderIssueTitle(&markup.RenderContext{ Ctx: ctx, URLPrefix: urlPrefix, @@ -803,6 +872,7 @@ func RenderIssueTitle(ctx context.Context, text, urlPrefix string, metas map[str log.Error("RenderIssueTitle: %v", err) return template.HTML("") } + _, renderedText = charset.EscapeControlHTML(renderedText, locale) return template.HTML(renderedText) } @@ -830,7 +900,7 @@ func ReactionToEmoji(reaction string) template.HTML { } // RenderNote renders the contents of a git-notes file as a commit message. -func RenderNote(ctx context.Context, msg, urlPrefix string, metas map[string]string) template.HTML { +func RenderNote(ctx context.Context, locale translation.Locale, msg, urlPrefix string, metas map[string]string) template.HTML { cleanMsg := template.HTMLEscapeString(msg) fullMessage, err := markup.RenderCommitMessage(&markup.RenderContext{ Ctx: ctx, @@ -841,6 +911,8 @@ func RenderNote(ctx context.Context, msg, urlPrefix string, metas map[string]str log.Error("RenderNote: %v", err) return "" } + _, fullMessage = charset.EscapeControlHTML(fullMessage, locale) + return template.HTML(fullMessage) } diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini index 0e309279d29b6..58330361ca6e0 100644 --- a/options/locale/locale_en-US.ini +++ b/options/locale/locale_en-US.ini @@ -106,6 +106,9 @@ never = Never rss_feed = RSS Feed +invisible_runes = `This field has invisible unicode characters` +ambiguous_runes = `This field has ambiguous unicode characters` + [error] occurred = An error occurred report_message = If you are sure this is a Gitea bug, please search for issues on GitHub or open a new issue if necessary. diff --git a/routers/web/feed/convert.go b/routers/web/feed/convert.go index 978469d1259d0..353f5daf6ca1a 100644 --- a/routers/web/feed/convert.go +++ b/routers/web/feed/convert.go @@ -202,7 +202,7 @@ func feedActionsToFeedItems(ctx *context.Context, actions models.ActionList) (it desc += fmt.Sprintf("%s\n%s", html.EscapeString(fmt.Sprintf("%s/commit/%s", act.GetRepoLink(), commit.Sha1)), commit.Sha1, - templates.RenderCommitMessage(ctx, commit.Message, repoLink, nil), + templates.RenderCommitMessage(ctx, ctx.Locale, commit.Message, repoLink, nil), ) } diff --git a/routers/web/repo/lfs.go b/routers/web/repo/lfs.go index baec48bfea770..25462319e469b 100644 --- a/routers/web/repo/lfs.go +++ b/routers/web/repo/lfs.go @@ -309,7 +309,7 @@ func LFSFileGet(ctx *context.Context) { // Building code view blocks with line number on server side. escapedContent := &bytes.Buffer{} - ctx.Data["EscapeStatus"], _ = charset.EscapeControlReader(rd, escapedContent, ctx.Locale) + ctx.Data["EscapeStatus"], _ = charset.EscapeControlHTMLReader(rd, escapedContent, ctx.Locale) var output bytes.Buffer lines := strings.Split(escapedContent.String(), "\n") diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go index 72ffda7e01476..fe0f633941237 100644 --- a/routers/web/repo/view.go +++ b/routers/web/repo/view.go @@ -339,7 +339,7 @@ func renderReadmeFile(ctx *context.Context, readmeFile *namedBlob, readmeTreelin if err != nil { log.Error("Render failed for %s in %-v: %v Falling back to rendering source", readmeFile.name, ctx.Repo.Repository, err) buf := &bytes.Buffer{} - ctx.Data["EscapeStatus"], _ = charset.EscapeControlReader(rd, buf, ctx.Locale) + ctx.Data["EscapeStatus"], _ = charset.EscapeControlHTMLReader(rd, buf, ctx.Locale) ctx.Data["FileContent"] = strings.ReplaceAll( gotemplate.HTMLEscapeString(buf.String()), "\n", `
`, ) @@ -347,7 +347,7 @@ func renderReadmeFile(ctx *context.Context, readmeFile *namedBlob, readmeTreelin } else { ctx.Data["IsRenderedHTML"] = true buf := &bytes.Buffer{} - ctx.Data["EscapeStatus"], err = charset.EscapeControlReader(rd, &charset.BreakWriter{Writer: buf}, ctx.Locale, charset.RuneNBSP) + ctx.Data["EscapeStatus"], err = charset.EscapeControlHTMLReader(rd, &charset.BreakWriter{Writer: buf}, ctx.Locale, charset.RuneNBSP) if err != nil { log.Error("Read failed: %v", err) } @@ -517,7 +517,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry, treeLink, rawLink st buf := &bytes.Buffer{} ctx.Data["IsRenderedHTML"] = true - ctx.Data["EscapeStatus"], _ = charset.EscapeControlReader(rd, buf, ctx.Locale) + ctx.Data["EscapeStatus"], _ = charset.EscapeControlHTMLReader(rd, buf, ctx.Locale) ctx.Data["FileContent"] = strings.ReplaceAll( gotemplate.HTMLEscapeString(buf.String()), "\n", `
`, @@ -644,7 +644,7 @@ func markupRender(ctx *context.Context, renderCtx *markup.RenderContext, input i go func() { sb := &strings.Builder{} // We allow NBSP here this is rendered - escaped, _ = charset.EscapeControlReader(markupRd, sb, ctx.Locale, charset.RuneNBSP) + escaped, _ = charset.EscapeControlHTMLReader(markupRd, sb, ctx.Locale, charset.RuneNBSP) output = sb.String() close(done) }() diff --git a/routers/web/repo/wiki.go b/routers/web/repo/wiki.go index 4cd5856ea647e..494e95f44888a 100644 --- a/routers/web/repo/wiki.go +++ b/routers/web/repo/wiki.go @@ -247,7 +247,7 @@ func renderViewPage(ctx *context.Context) (*git.Repository, *git.TreeEntry) { done := make(chan struct{}) go func() { // We allow NBSP here this is rendered - escaped, _ = charset.EscapeControlReader(markupRd, buf, ctx.Locale, charset.RuneNBSP) + escaped, _ = charset.EscapeControlHTMLReader(markupRd, buf, ctx.Locale, charset.RuneNBSP) output = buf.String() buf.Reset() close(done) diff --git a/templates/admin/emails/list.tmpl b/templates/admin/emails/list.tmpl index adf5b9bef7b6f..095b9e28a0285 100644 --- a/templates/admin/emails/list.tmpl +++ b/templates/admin/emails/list.tmpl @@ -29,7 +29,7 @@ -
+
@@ -50,8 +50,8 @@ {{range .Emails}} - - + +
{{.Name}}{{.FullName}}{{escapeAmbiguous $.locale .FullName}} {{if .IsPrimary}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}} {{if .CanChange}} diff --git a/templates/admin/user/list.tmpl b/templates/admin/user/list.tmpl index 061e66385021d..c3f2377678d59 100644 --- a/templates/admin/user/list.tmpl +++ b/templates/admin/user/list.tmpl @@ -60,7 +60,7 @@ -
+
@@ -88,7 +88,7 @@ - + diff --git a/templates/base/head_script.tmpl b/templates/base/head_script.tmpl index 48a3df693a39b..c5e2c11dea69f 100644 --- a/templates/base/head_script.tmpl +++ b/templates/base/head_script.tmpl @@ -19,14 +19,15 @@ If you introduce mistakes in it, Gitea JavaScript code wouldn't run correctly. notificationSettings: {{NotificationSettings}}, {{/*a map provided by NewFuncMap in helper.go*/}} enableTimeTracking: {{EnableTimetracking}}, {{if .RequireTribute}} + {{- /* WARNING: fullname below is assumed to be safe for HTML in tribute.js do not add unescaped content as fullname */}} tributeValues: Array.from(new Map([ {{ range .Participants }} ['{{.Name}}', {key: '{{.Name}} {{.FullName}}', value: '{{.Name}}', - name: '{{.Name}}', fullname: '{{.FullName}}', avatar: '{{.AvatarLink}}'}], + name: '{{.Name}}', fullname: '{{escapeAmbiguous $.locale .FullName}}', avatar: '{{.AvatarLink}}'}], {{ end }} {{ range .Assignees }} ['{{.Name}}', {key: '{{.Name}} {{.FullName}}', value: '{{.Name}}', - name: '{{.Name}}', fullname: '{{.FullName}}', avatar: '{{.AvatarLink}}'}], + name: '{{.Name}}', fullname: '{{escapeAmbiguous $.locale .FullName}}', avatar: '{{.AvatarLink}}'}], {{ end }} {{ range .MentionableTeams }} ['{{$.MentionableTeamsOrg}}/{{.Name}}', {key: '{{$.MentionableTeamsOrg}}/{{.Name}}', value: '{{$.MentionableTeamsOrg}}/{{.Name}}', diff --git a/templates/explore/organizations.tmpl b/templates/explore/organizations.tmpl index 2073b8c69c697..230392f962545 100644 --- a/templates/explore/organizations.tmpl +++ b/templates/explore/organizations.tmpl @@ -10,7 +10,7 @@ {{avatar .}}
- {{.Name}} {{.FullName}} + {{.Name}} {{escapeAmbiguous $.locale .FullName}} {{if .Visibility.IsPrivate}} {{$.locale.Tr "repo.desc.private"}} {{end}} diff --git a/templates/explore/users.tmpl b/templates/explore/users.tmpl index 94a21d9959583..b211884af3235 100644 --- a/templates/explore/users.tmpl +++ b/templates/explore/users.tmpl @@ -4,19 +4,19 @@
{{template "explore/search" .}} -
+
{{range .Users}}
{{avatar .}}
- {{.Name}} {{.FullName}} + {{.Name}} {{escapeAmbiguous $.locale .FullName}}
{{if .Location}} - {{svg "octicon-location"}} {{.Location}} + {{svg "octicon-location"}} {{escapeAmbiguous $.locale .Location}} {{end}} {{if and $.ShowUserEmail .Email $.IsSigned (not .KeepEmailPrivate)}} {{svg "octicon-mail"}} - {{.Email}} + {{escapeAmbiguousLink $.locale .Email (printf "mailto:%s" .Email)}} {{end}} {{svg "octicon-clock"}} {{$.locale.Tr "user.join_on"}} {{.CreatedUnix.FormatShort}}
diff --git a/templates/org/home.tmpl b/templates/org/home.tmpl index 3ff86259d53f2..2233f633ad8fe 100644 --- a/templates/org/home.tmpl +++ b/templates/org/home.tmpl @@ -2,7 +2,7 @@
{{avatar .Org 140 "org-avatar"}} -
+
{{.Org.DisplayName}} {{svg "octicon-rss" 36}} @@ -11,10 +11,10 @@ {{if .Org.Visibility.IsPrivate}}
{{.locale.Tr "org.settings.visibility.private_shortname"}}
{{end}}
- {{if $.RenderedDescription}}

{{$.RenderedDescription|Str2html}}

{{end}} + {{if $.RenderedDescription}}

{{escapeAmbiguousHTML .locale $.RenderedDescription}}

{{end}}
{{if .Org.Location}}
{{svg "octicon-location"}} {{.Org.Location}}
{{end}} - {{if .Org.Website}}
{{svg "octicon-link"}} {{.Org.Website}}
{{end}} + {{if .Org.Website}}
{{svg "octicon-link"}} {{escapeAmbiguousLink .locale .Org.Website .Org.Website "target" "_blank" "rel" "nopener noreferrer"}}
{{end}}
diff --git a/templates/repo/branch/list.tmpl b/templates/repo/branch/list.tmpl index 09799fbece577..cd9758c0d5290 100644 --- a/templates/repo/branch/list.tmpl +++ b/templates/repo/branch/list.tmpl @@ -18,7 +18,7 @@ {{svg "octicon-shield-lock"}} {{end}} {{.DefaultBranch}} -

{{svg "octicon-git-commit" 16 "mr-2"}}{{ShortSha .DefaultBranchBranch.Commit.ID.String}} · {{RenderCommitMessage $.Context .DefaultBranchBranch.Commit.CommitMessage .RepoLink .Repository.ComposeMetas}} · {{.locale.Tr "org.repo_updated"}} {{TimeSince .DefaultBranchBranch.Commit.Committer.When .locale}}

+

{{svg "octicon-git-commit" 16 "mr-2"}}{{ShortSha .DefaultBranchBranch.Commit.ID.String}} · {{RenderCommitMessage $.Context $.locale .DefaultBranchBranch.Commit.CommitMessage .RepoLink .Repository.ComposeMetas}} · {{.locale.Tr "org.repo_updated"}} {{TimeSince .DefaultBranchBranch.Commit.Committer.When .locale}}

{{.ID}} {{.Name}} {{if .IsActive}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}} {{if .IsAdmin}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}} {{if .IsRestricted}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}} {{if and $.IsWriter (not $.Repository.IsArchived) (not .IsDeleted)}} @@ -61,7 +61,7 @@ {{svg "octicon-shield-lock"}} {{end}} {{.Name}} -

{{svg "octicon-git-commit" 16 "mr-2"}}{{ShortSha .Commit.ID.String}} · {{RenderCommitMessage $.Context .Commit.CommitMessage $.RepoLink $.Repository.ComposeMetas}} · {{$.locale.Tr "org.repo_updated"}} {{TimeSince .Commit.Committer.When $.locale}}

+

{{svg "octicon-git-commit" 16 "mr-2"}}{{ShortSha .Commit.ID.String}} · {{RenderCommitMessage $.Context $.locale .Commit.CommitMessage $.RepoLink $.Repository.ComposeMetas}} · {{$.locale.Tr "org.repo_updated"}} {{TimeSince .Commit.Committer.When $.locale}}

{{end}} 		diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl index 4c4f6f5bc8faf..e2acf0716548c 100644 --- a/templates/repo/commit_page.tmpl +++ b/templates/repo/commit_page.tmpl @@ -1,5 +1,5 @@ {{template "base/head" .}} -
+
{{template "repo/header" .}}
{{$class := ""}} @@ -19,7 +19,7 @@ {{end}}
-

{{RenderCommitMessage $.Context .Commit.Message $.RepoLink $.Repository.ComposeMetas}}{{template "repo/commit_statuses" dict "Status" .CommitStatus "Statuses" .CommitStatuses "root" $}}

+

{{RenderCommitMessage $.Context $.locale .Commit.Message $.RepoLink $.Repository.ComposeMetas}}{{template "repo/commit_statuses" dict "Status" .CommitStatus "Statuses" .CommitStatuses "root" $}}

{{if not $.PageIsWiki}}
@@ -134,13 +134,13 @@ {{end}}
{{if IsMultilineCommitMessage .Commit.Message}} - 
{{RenderCommitBody $.Context .Commit.Message $.RepoLink $.Repository.ComposeMetas}}
+ 
{{RenderCommitBody $.Context $.locale .Commit.Message $.RepoLink $.Repository.ComposeMetas}}
{{end}} {{if .BranchName}} - {{svg "octicon-git-branch" 16 "mr-2"}}{{.BranchName}} + {{svg "octicon-git-branch" 16 "mr-2"}}{{escapeAmbiguous $.locale .BranchName}} {{end}} {{if .TagName}} - {{svg "octicon-tag" 16 "mr-2"}}{{.TagName}} + {{svg "octicon-tag" 16 "mr-2"}}{{escapeAmbiguous $.locale .TagName}} {{end}}
@@ -148,23 +148,23 @@ {{if .Author}} {{avatar .Author 28 "mr-3"}} {{if .Author.FullName}} - {{.Author.FullName}} + {{escapeAmbiguousLink $.locale .Author.FullName .Author.HomeLink "class" "strong"}} {{else}} - {{.Commit.Author.Name}} + {{escapeAmbiguousLink $.locale .Author.FullName .Commit.Author.Name "class" "strong"}} {{end}} {{else}} {{avatarByEmail .Commit.Author.Email .Commit.Author.Email 28 "mr-3"}} - {{.Commit.Author.Name}} + {{escapeAmbiguous $.locale .Commit.Author.Name}} {{end}} {{TimeSince .Commit.Author.When $.locale}} {{if or (ne .Commit.Committer.Name .Commit.Author.Name) (ne .Commit.Committer.Email .Commit.Author.Email)}} {{.locale.Tr "repo.diff.committed_by"}} {{if ne .Verification.CommittingUser.ID 0}} {{avatar .Verification.CommittingUser 28 "mx-3"}} - {{.Commit.Committer.Name}} + {{escapeAmbiguousLink $.locale .Verification.CommittingUser.HomeLink .Commit.Committer.Name "class" "strong"}} {{else}} {{avatarByEmail .Commit.Committer.Email .Commit.Committer.Name 28 "mr-3"}} - {{.Commit.Committer.Name}} + {{escapeAmbiguous $.locale .Commit.Committer.Name}} {{end}} {{end}}
@@ -206,7 +206,7 @@ {{svg "gitea-lock-cog" 16 "mr-3"}} {{.locale.Tr "repo.commits.signed_by"}}: {{avatarByEmail .Verification.SigningEmail "" 28}} - {{.Verification.SigningUser.GetDisplayName}} + {{escapeAmbiguous $.locale .Verification.SigningUser.GetDisplayName}} {{end}} {{else}} {{svg "gitea-unlock" 16 "mr-3"}} @@ -269,18 +269,18 @@ {{if .NoteAuthor}} {{if .NoteAuthor.FullName}} - {{.NoteAuthor.FullName}} + {{escapeAmbiguous $.locale .NoteAuthor.FullName}} {{else}} - {{.NoteCommit.Author.Name}} + {{escapeAmbiguous $.locale .NoteCommit.Author.Name}} {{end}} {{else}} - {{.NoteCommit.Author.Name}} + {{escapeAmbiguous $.locale .NoteCommit.Author.Name}} {{end}} {{TimeSince .NoteCommit.Author.When $.locale}}
- 
{{RenderNote $.Context .Note $.RepoLink $.Repository.ComposeMetas}}
+ 
{{RenderNote $.Context $.locale .Note $.RepoLink $.Repository.ComposeMetas}}
{{end}} {{template "repo/diff/box" .}} diff --git a/templates/repo/commits_list.tmpl b/templates/repo/commits_list.tmpl index 1003f2ee7489a..f4e4f24a38d4c 100644 --- a/templates/repo/commits_list.tmpl +++ b/templates/repo/commits_list.tmpl @@ -1,4 +1,4 @@ -
+
@@ -18,10 +18,10 @@ {{if .User.FullName}} {{$userName = .User.FullName}} {{end}} - {{avatar .User 28 "mr-2"}}{{$userName}} + {{avatar .User 28 "mr-2"}}{{escapeAmbiguousLink $.locale $userName .User.HomeLink}} {{else}} {{avatarByEmail .Author.Email .Author.Name 28 "mr-2"}} - {{$userName}} + {{escapeAmbiguous $.locale $userName}} {{end}} {{if .Committer}} diff --git a/templates/repo/commits_list_small.tmpl b/templates/repo/commits_list_small.tmpl index c1e136318740b..d5a89999b7e1e 100644 --- a/templates/repo/commits_list_small.tmpl +++ b/templates/repo/commits_list_small.tmpl @@ -1,5 +1,5 @@ {{ $index := 0}} -
+
{{range .comment.Commits}} {{ $tag := printf "%s-%d" $.comment.HashTag $index }} {{ $index = Add $index 1}} @@ -47,12 +47,12 @@ {{ $commitLink:= printf "%s/commit/%s" $.comment.Issue.PullRequest.BaseRepo.Link (PathEscape .ID.String) }} - {{RenderCommitMessageLinkSubject $.root.Context .Message ($.comment.Issue.PullRequest.BaseRepo.Link|Escape) $commitLink $.comment.Issue.PullRequest.BaseRepo.ComposeMetas}} + {{RenderCommitMessageLinkSubject $.root.Context $.root.locale .Message ($.comment.Issue.PullRequest.BaseRepo.Link|Escape) $commitLink $.comment.Issue.PullRequest.BaseRepo.ComposeMetas}} {{if IsMultilineCommitMessage .Message}} {{end}} {{if IsMultilineCommitMessage .Message}} - + {{end}}
{{end}} diff --git a/templates/repo/diff/compare.tmpl b/templates/repo/diff/compare.tmpl index 426ea737bda74..95d9e34ba638c 100644 --- a/templates/repo/diff/compare.tmpl +++ b/templates/repo/diff/compare.tmpl @@ -191,7 +191,7 @@
{{.locale.Tr "repo.pulls.has_pull_request" (Escape $.RepoLink) (Escape $.RepoRelPath) .PullRequest.Index | Safe}}

- {{RenderIssueTitle $.Context .PullRequest.Issue.Title $.RepoLink $.Repository.ComposeMetas}} + {{RenderIssueTitle $.Context $.locale .PullRequest.Issue.Title $.RepoLink $.Repository.ComposeMetas}} #{{.PullRequest.Issue.Index}}

diff --git a/templates/repo/graph/commits.tmpl b/templates/repo/graph/commits.tmpl index 478121f27ce5a..b35fac4e5a378 100644 --- a/templates/repo/graph/commits.tmpl +++ b/templates/repo/graph/commits.tmpl @@ -1,4 +1,4 @@ -
+
    {{ range $commitI, $commit := .Graph.Commits }}
  • @@ -29,7 +29,7 @@ - {{RenderCommitMessage $.Context $commit.Subject $.RepoLink $.Repository.ComposeMetas}} + {{RenderCommitMessage $.Context $.locale $commit.Subject $.RepoLink $.Repository.ComposeMetas}} {{range $commit.Refs}} @@ -65,10 +65,10 @@ {{$userName = $commit.User.FullName}} {{end}} {{avatar $commit.User}} - {{$userName}} + {{escapeAmbiguousLink $.locale $userName $commit.User.HomeLink}} {{else}} {{avatarByEmail $commit.Commit.Author.Email $userName}} - {{$userName}} + {{escapeAmbiguous $.locale $userName}} {{end}} {{$commit.Date}} diff --git a/templates/repo/issue/view_title.tmpl b/templates/repo/issue/view_title.tmpl index 456515af33100..57c08971fc78d 100644 --- a/templates/repo/issue/view_title.tmpl +++ b/templates/repo/issue/view_title.tmpl @@ -6,7 +6,7 @@
{{end}}

- {{RenderIssueTitle $.Context .Issue.Title $.RepoLink $.Repository.ComposeMetas}} + {{RenderIssueTitle $.Context $.locale .Issue.Title $.RepoLink $.Repository.ComposeMetas}} #{{.Issue.Index}} diff --git a/templates/repo/settings/tags.tmpl b/templates/repo/settings/tags.tmpl index d18061c1158bf..b01c2025ce433 100644 --- a/templates/repo/settings/tags.tmpl +++ b/templates/repo/settings/tags.tmpl @@ -37,7 +37,7 @@ {{range .Users}}
{{avatar . 28 "mini"}} - {{.GetDisplayName}} + {{escapeAmbiguous $.locale .GetDisplayName}}
{{end}}

diff --git a/templates/repo/view_list.tmpl b/templates/repo/view_list.tmpl index bd26fac24c4d2..d600d5fafd410 100644 --- a/templates/repo/view_list.tmpl +++ b/templates/repo/view_list.tmpl @@ -1,4 +1,4 @@ -
@@ -64,7 +64,7 @@ {{.Summary | RenderEmoji}} {{else }} {{ $commitLink:= printf "%s/commit/%s" $commitRepoLink (PathEscape .ID.String) }} - {{RenderCommitMessageLinkSubject $.Context .Message $commitRepoLink $commitLink $.Repository.ComposeMetas}} + {{RenderCommitMessageLinkSubject $.Context $.locale .Message $commitRepoLink $commitLink $.Repository.ComposeMetas}} {{end}} {{if IsMultilineCommitMessage .Message}} @@ -72,7 +72,7 @@ {{end}} {{template "repo/commit_statuses" dict "Status" .Status "Statuses" .Statuses "root" $}} {{if IsMultilineCommitMessage .Message}} - + {{end}}
+
@@ -8,14 +8,16 @@ {{if .LatestCommitUser}} {{avatar .LatestCommitUser 24}} {{if .LatestCommitUser.FullName}} - {{.LatestCommitUser.FullName}} + {{escapeAmbiguousLink $.locale .LatestCommitUser.FullName "class" "muted strong"}} + {{else if .LatestCommit.Author}} + {{escapeAmbiguousLink $.locale .LatestCommit.Author.Name "class" "muted strong"}} {{else}} - {{if .LatestCommit.Author}}{{.LatestCommit.Author.Name}}{{else}}{{.LatestCommitUser.Name}}{{end}} + {{.LatestCommitUser.Name}} {{end}} {{else}} {{if .LatestCommit.Author}} {{avatarByEmail .LatestCommit.Author.Email .LatestCommit.Author.Name 24}} - {{.LatestCommit.Author.Name}} + {{escapeAmbiguous $.locale .LatestCommit.Author.Name}} {{end}} {{end}} @@ -26,10 +28,10 @@ {{template "repo/commit_statuses" dict "Status" .LatestCommitStatus "Statuses" .LatestCommitStatuses "root" $}} {{ $commitLink:= printf "%s/commit/%s" .RepoLink (PathEscape .LatestCommit.ID.String) }} - {{RenderCommitMessageLinkSubject $.Context .LatestCommit.Message $.RepoLink $commitLink $.Repository.ComposeMetas}} + {{RenderCommitMessageLinkSubject $.Context $.locale .LatestCommit.Message $.RepoLink $commitLink $.Repository.ComposeMetas}} {{if IsMultilineCommitMessage .LatestCommit.Message}} - + {{end}} {{end}} @@ -81,7 +83,7 @@ {{if $commit}} {{$commitLink := printf "%s/commit/%s" $.RepoLink (PathEscape $commit.ID.String)}} - {{RenderCommitMessageLinkSubject $.Context $commit.Message $.RepoLink $commitLink $.Repository.ComposeMetas}} + {{RenderCommitMessageLinkSubject $.Context $.locale $commit.Message $.RepoLink $commitLink $.Repository.ComposeMetas}} {{else}}
…
{{end}} diff --git a/templates/user/auth/activate.tmpl b/templates/user/auth/activate.tmpl index eba9e3229b211..810ba2fb83865 100644 --- a/templates/user/auth/activate.tmpl +++ b/templates/user/auth/activate.tmpl @@ -7,7 +7,7 @@

{{.locale.Tr "auth.active_your_account"}}

-
+
{{template "base/alert" .}} {{if .IsActivatePage}} {{if .ServiceNotEnabled}} @@ -15,7 +15,7 @@ {{else if .ResendLimited}}

{{.locale.Tr "auth.resent_limit_prompt"}}

{{else}} -

{{.locale.Tr "auth.confirmation_mail_sent_prompt" (.SignedUser.Email|Escape) .ActiveCodeLives | Str2html}}

+

{{.locale.Tr "auth.confirmation_mail_sent_prompt" (escapeAmbiguous .locale .SignedUser.Email) .ActiveCodeLives | Str2html}}

{{end}} {{else}} {{if .NeedsPassword}} @@ -29,13 +29,13 @@
{{else if .IsSendRegisterMail}} -

{{.locale.Tr "auth.confirmation_mail_sent_prompt" (.Email|Escape) .ActiveCodeLives | Str2html}}

+

{{.locale.Tr "auth.confirmation_mail_sent_prompt" (escapeAmbiguous .locale .Email) .ActiveCodeLives | Str2html}}

{{else if .IsActivateFailed}}

{{.locale.Tr "auth.invalid_code"}}

{{else if .ManualActivationOnly}}

{{.locale.Tr "auth.manual_activation_only"}}

{{else}} -

{{.locale.Tr "auth.has_unconfirmed_mail" (.SignedUser.Name|Escape) (.SignedUser.Email|Escape) | Str2html}}

+

{{.locale.Tr "auth.has_unconfirmed_mail" (escapeAmbiguous .locale .SignedUser.Name) (escapeAmbiguous .locale .SignedUser.Email) | Str2html}}

diff --git a/templates/user/auth/forgot_passwd.tmpl b/templates/user/auth/forgot_passwd.tmpl index cd42085e28335..61dd4b223e6fd 100644 --- a/templates/user/auth/forgot_passwd.tmpl +++ b/templates/user/auth/forgot_passwd.tmpl @@ -7,10 +7,10 @@

{{.locale.Tr "auth.forgot_password_title"}}

-
+
{{template "base/alert" .}} {{if .IsResetSent}} -

{{.locale.Tr "auth.reset_password_mail_sent_prompt" (Escape .Email) .ResetPwdCodeLives | Str2html}}

+

{{.locale.Tr "auth.reset_password_mail_sent_prompt" (escapeAmbiguous .locale .Email) .ResetPwdCodeLives | Str2html}}

{{else if .IsResetRequest}}
diff --git a/templates/user/dashboard/feeds.tmpl b/templates/user/dashboard/feeds.tmpl index 95e223925749d..dfe42ccbc3df0 100644 --- a/templates/user/dashboard/feeds.tmpl +++ b/templates/user/dashboard/feeds.tmpl @@ -91,7 +91,7 @@ {{avatarHTML ($push.AvatarLink .AuthorEmail) 16 "mr-2" .AuthorName}} {{ShortSha .Sha1}} - {{RenderCommitMessage $.Context .Message $repoLink $.ComposeMetas}} + {{RenderCommitMessage $.Context $.locale .Message $repoLink $.ComposeMetas}} {{end}} diff --git a/templates/user/profile.tmpl b/templates/user/profile.tmpl index 2a973c2d5bc04..5c0a36262d394 100644 --- a/templates/user/profile.tmpl +++ b/templates/user/profile.tmpl @@ -3,7 +3,7 @@
-
+
{{if eq .SignedUserName .Owner.Name}} @@ -16,7 +16,7 @@ {{end}}
- {{if .Owner.FullName}}{{.Owner.FullName}}{{end}} + {{if .Owner.FullName}}{{escapeAmbiguous .locale .Owner.FullName}}{{end}} {{.Owner.Name}} {{svg "octicon-rss" 18}}
@@ -26,23 +26,23 @@
    {{if .Owner.Location}} -
  • {{svg "octicon-location"}} {{.Owner.Location}}
    • +
  • {{svg "octicon-location"}} {{escapeAmbiguous .locale .Owner.Location}}
    • {{end}} {{if .ShowUserEmail }}
  • {{svg "octicon-mail"}} - {{.Owner.Email}} + {{escapeAmbiguousLink .locale .Owner.Email (printf "mailto:%s" .Owner.Email) "rel" "nofollow"}}
    • {{end}} {{if .Owner.Website}}
  • {{svg "octicon-link"}} - {{.Owner.Website}} + {{escapeAmbiguousLink .locale .Owner.Website .Owner.Website "target" "_blank" "rel" "noopener noreferrer me"}}
    • {{end}} {{if $.RenderedDescription}}
  • -
    {{$.RenderedDescription|Str2html}}
    +
    {{escapeAmbiguousHTML .locale $.RenderedDescription}}
    • {{end}} {{range .OpenIDs}} diff --git a/templates/user/settings/account.tmpl b/templates/user/settings/account.tmpl index 53fd25313a832..5f1f231b587c8 100644 --- a/templates/user/settings/account.tmpl +++ b/templates/user/settings/account.tmpl @@ -41,7 +41,7 @@

    {{.locale.Tr "settings.manage_emails"}}

    -
    +