Skip to content
This repository was archived by the owner on Nov 8, 2022. It is now read-only.

Commit a7e2392

Browse files
mydearxymmydearxym
committed
chore: Merge branch 'dev'
2 parents d838993 + 59d3156 commit a7e2392

File tree

18 files changed

+146
-76
lines changed

18 files changed

+146
-76
lines changed

‎lib/groupher_server/cms/job.ex‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ defmodule GroupherServer.CMS.Job do
1616
Tag
1717
}
1818

19+
alias Helper.HTML
20+
1921
@timestamps_opts [type: :utc_datetime_usec]
2022
@required_fields ~w(title company company_logo body digest length)a
2123
@optional_fields ~w(origial_community_id desc company_link link_addr copy_right salary exp education field finance scale)a
@@ -96,11 +98,6 @@ defmodule GroupherServer.CMS.Job do
9698
content
9799
|> validate_length(:title, min: 3, max: 50)
98100
|> validate_length(:body, min: 3, max: 10_000)
99-
end
100-
101-
@doc false
102-
def update_changeset(%Job{} = job, attrs) do
103-
job
104-
|> cast(attrs, @optional_fields ++ @required_fields)
101+
|> HTML.safe_string(:body)
105102
end
106103
end

‎lib/groupher_server/cms/job_comment.ex‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ defmodule GroupherServer.CMS.JobComment do
77
alias GroupherServer.Accounts
88

99
alias GroupherServer.CMS.{Job, JobCommentReply, JobCommentLike, JobCommentDislike}
10+
alias Helper.HTML
1011

1112
@required_fields ~w(body author_id job_id floor)a
1213
@optional_fields ~w(reply_id)a
@@ -46,13 +47,6 @@ defmodule GroupherServer.CMS.JobComment do
4647
|> foreign_key_constraint(:job_id)
4748
|> foreign_key_constraint(:author_id)
4849
|> validate_length(:body, min: 3, max: 2000)
49-
end
50-
51-
@doc false
52-
def update_changeset(%JobComment{} = job_comment, attrs) do
53-
job_comment
54-
|> cast(attrs, @required_fields ++ @optional_fields)
55-
|> foreign_key_constraint(:job_id)
56-
|> foreign_key_constraint(:author_id)
50+
|> HTML.safe_string(:body)
5751
end
5852
end

‎lib/groupher_server/cms/post.ex‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ defmodule GroupherServer.CMS.Post do
1717
Topic
1818
}
1919

20+
alias Helper.HTML
21+
2022
@timestamps_opts [type: :utc_datetime_usec]
2123
@required_fields ~w(title body digest length)a
2224
@optional_fields ~w(origial_community_id link_addr copy_right link_addr link_icon)a
@@ -104,15 +106,7 @@ defmodule GroupherServer.CMS.Post do
104106
|> validate_length(:title, min: 3, max: 50)
105107
|> validate_length(:body, min: 3, max: 10_000)
106108
|> validate_length(:link_addr, min: 5, max: 400)
107-
108-
# |> foreign_key_constraint(:posts_tags, name: :posts_tags_tag_id_fkey)
109-
# |> foreign_key_constraint(name: :posts_tags_tag_id_fkey)
110-
end
111-
112-
@doc false
113-
def update_changeset(%Post{} = post, attrs) do
114-
post
115-
|> cast(attrs, @optional_fields ++ @required_fields)
109+
|> HTML.safe_string(:body)
116110

117111
# |> foreign_key_constraint(:posts_tags, name: :posts_tags_tag_id_fkey)
118112
# |> foreign_key_constraint(name: :posts_tags_tag_id_fkey)

‎lib/groupher_server/cms/post_comment.ex‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ defmodule GroupherServer.CMS.PostComment do
1313
PostCommentReply
1414
}
1515

16+
alias Helper.HTML
17+
1618
@required_fields ~w(body author_id post_id floor)a
1719
@optional_fields ~w(reply_id)a
1820

@@ -51,13 +53,14 @@ defmodule GroupherServer.CMS.PostComment do
5153
|> foreign_key_constraint(:post_id)
5254
|> foreign_key_constraint(:author_id)
5355
|> validate_length(:body, min: 3, max: 2000)
56+
|> HTML.safe_string(:body)
5457
end
5558

56-
@doc false
57-
def update_changeset(%PostComment{} = post_comment, attrs) do
58-
post_comment
59-
|> cast(attrs, @required_fields ++ @optional_fields)
60-
|> foreign_key_constraint(:post_id)
61-
|> foreign_key_constraint(:author_id)
62-
end
59+
# @doc false
60+
# def update_changeset(%PostComment{} = post_comment, attrs) do
61+
# post_comment
62+
# |> cast(attrs, @required_fields ++ @optional_fields)
63+
# |> foreign_key_constraint(:post_id)
64+
# |> foreign_key_constraint(:author_id)
65+
# end
6366
end

‎lib/groupher_server/cms/repo.ex‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ defmodule GroupherServer.CMS.Repo do
1717
Tag
1818
}
1919

20+
alias Helper.HTML
21+
2022
@timestamps_opts [type: :utc_datetime_usec]
2123
@required_fields ~w(title owner_name owner_url repo_url desc readme star_count issues_count prs_count fork_count watch_count)a
2224
@optional_fields ~w(origial_community_id last_sync homepage_url release_tag license)a
@@ -100,13 +102,6 @@ defmodule GroupherServer.CMS.Repo do
100102
|> validate_length(:title, min: 1, max: 80)
101103
|> cast_embed(:contributors, with: &RepoContributor.changeset/2)
102104
|> cast_embed(:primary_language, with: &RepoLang.changeset/2)
103-
end
104-
105-
@doc false
106-
def update_changeset(%Repo{} = repo, attrs) do
107-
repo
108-
|> cast(attrs, @optional_fields ++ @required_fields)
109-
|> cast_embed(:contributors, with: &RepoContributor.changeset/2)
110-
|> cast_embed(:primary_language, with: &RepoLang.changeset/2)
105+
|> HTML.safe_string(:readme)
111106
end
112107
end

‎lib/groupher_server/cms/repo_comment.ex‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ defmodule GroupherServer.CMS.RepoComment do
1313
RepoCommentReply
1414
}
1515

16+
alias Helper.HTML
17+
1618
@required_fields ~w(body author_id repo_id floor)a
1719
@optional_fields ~w(reply_id)a
1820

@@ -51,14 +53,6 @@ defmodule GroupherServer.CMS.RepoComment do
5153
|> foreign_key_constraint(:repo_id)
5254
|> foreign_key_constraint(:author_id)
5355
|> validate_length(:body, min: 3, max: 2000)
54-
end
55-
56-
@doc false
57-
def update_changeset(%RepoComment{} = repo_comment, attrs) do
58-
repo_comment
59-
|> cast(attrs, @required_fields ++ @optional_fields)
60-
|> validate_length(:body, min: 1)
61-
|> foreign_key_constraint(:repo_id)
62-
|> foreign_key_constraint(:author_id)
56+
|> HTML.safe_string(:body)
6357
end
6458
end

‎lib/groupher_server/cms/video.ex‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,4 @@ defmodule GroupherServer.CMS.Video do
9393
|> validate_length(:original_author_link, min: 5, max: 200)
9494
|> validate_length(:link, min: 5, max: 200)
9595
end
96-
97-
def update_changeset(%Video{} = video, attrs) do
98-
video
99-
|> cast(attrs, @optional_fields)
100-
|> validate_length(:original_author, min: 3, max: 30)
101-
end
10296
end

‎lib/groupher_server/cms/video_comment.ex‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ defmodule GroupherServer.CMS.VideoComment do
1313
VideoCommentReply
1414
}
1515

16+
alias Helper.HTML
17+
1618
@required_fields ~w(body author_id video_id floor)a
1719
@optional_fields ~w(reply_id)a
1820

@@ -51,14 +53,6 @@ defmodule GroupherServer.CMS.VideoComment do
5153
|> foreign_key_constraint(:video_id)
5254
|> foreign_key_constraint(:author_id)
5355
|> validate_length(:body, min: 3, max: 2000)
54-
end
55-
56-
@doc false
57-
def update_changeset(%VideoComment{} = video_comment, attrs) do
58-
video_comment
59-
|> cast(attrs, @required_fields ++ @optional_fields)
60-
|> validate_length(:body, min: 1)
61-
|> foreign_key_constraint(:video_id)
62-
|> foreign_key_constraint(:author_id)
56+
|> HTML.safe_string(:body)
6357
end
6458
end

‎lib/helper/html.ex‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
defmodule Helper.HTML do
2+
@moduledoc """
3+
escape unsafe inputs, especially for the markdown contents
4+
"""
5+
6+
import Ecto.Changeset
7+
alias Phoenix.HTML
8+
9+
def safe_string(%Ecto.Changeset{valid?: true, changes: changes} = changeset, field) do
10+
case Map.has_key?(changes, field) do
11+
true ->
12+
changeset
13+
|> put_change(field, escape_to_safe_string(changes[field]))
14+
15+
_ ->
16+
changeset
17+
end
18+
end
19+
20+
def safe_string(%Ecto.Changeset{} = changeset, _field), do: changeset
21+
22+
# def safe_string(%Ecto.Changeset{} = changeset, field) do
23+
# case changeset do
24+
# %Ecto.Changeset{valid?: true, changes: changes} ->
25+
# changeset
26+
# |> put_change(field, escape_to_safe_string(changes[field]))
27+
28+
# _ ->
29+
# changeset
30+
# end
31+
# end
32+
33+
defp escape_to_safe_string(v), do: v |> HTML.html_escape() |> HTML.safe_to_string()
34+
end

‎mix.exs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ defmodule GroupherServer.Mixfile do
5353
[
5454
{:phoenix, "~> 1.4.1"},
5555
{:phoenix_pubsub, "~> 1.1.1"},
56+
{:phoenix_html, "~> 2.13.3"},
5657
{:ecto_sql, "~> 3.1.2"},
5758
{:phoenix_ecto, "~> 4.0"},
5859
{:postgrex, ">= 0.14.1"},

0 commit comments

Comments
 (0)