fix https://freedit.eu/post/1/5#4

src/controller/admin.rs

@@ -123,7 +123,7 @@ pub(crate) async fn admin_view(
                 "posts" => {
                     let key = ivec_to_u32(&k);
                     let (one, _): (Post, usize) = bincode::decode_from_slice(&v, standard())?;
-                    let one_fmt = unescape(&format!("{}", one)).unwrap();
+                    let one_fmt = unescape(&format!("{:?}", one)).unwrap();
                     ones.push(format!("{key}: {one_fmt}"));
                 }
                 "post_comments" => {

src/controller/fmt.rs

@@ -115,6 +115,7 @@ impl<'a, I: Iterator<Item = Event<'a>>> Iterator for SyntaxPreprocessor<'a, I> {
                     .into(),
                 ));
             }
+            // for security reasons, we change all html tags to code blocks, but not `Event::InlineHtml` as @mention needs it
             Event::Html(html) => return Some(Event::Code(html)),
             other => return Some(other),
         };

src/controller/inn.rs

@@ -784,7 +784,7 @@ pub(crate) async fn edit_post_post(
         iid,
         title: clean_html(&input.title),
         tags,
-        content: PostContent::Markdown(content),
+        content: PostContent::Markdown(clean_html(&content)),
         created_at,
         status: PostStatus::Normal,
     };

src/controller/mod.rs

@@ -356,25 +356,12 @@ impl PostContent {
 impl Display for PostContent {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            PostContent::Markdown(c) => {
-                let s = md2html(c);
-                write!(f, "{s}")
-            }
+            PostContent::Markdown(c) => write!(f, "{c}"),
             PostContent::FeedItemId(id) => write!(f, "From item_id: {id}"),
         }
     }
 }
 
-impl Display for Post {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "pid: {}, uid: {}, iid: {}, title: {}, tags: {:?}, content: {}, created_at: {}, status: {}",
-            self.pid, self.uid, self.iid, self.title, self.tags, self.content, self.created_at, self.status
-        )
-    }
-}
-
 #[derive(Encode, Decode, Serialize, Debug)]
 struct Post {
     pid: u32,