Skip to content

Commit 6624b47

Browse files
iamareebjamaliamareebjamal
authored
fix: HTML syntax errors and XSS vulnerabilities (#2179)
Also add option to skip downloads to develop faster
1 parent 749d71c commit 6624b47

File tree

10 files changed

+84
-74
lines changed

10 files changed

+84
-74
lines changed

‎.gitignore

+3-1
Original file line numberDiff line numberDiff line change
@@ -46,4 +46,6 @@ jspm_packages
4646
/uploads
4747
/mockjson
4848

49-
configmap.yml.secret
49+
configmap.yml.secret
50+
51+
.tool-versions

‎src/backend/dist.js

+8
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,15 @@ const uploadsPath = __dirname + '/../../uploads';
1919
const mockPath = __dirname + '/../../mockjson';
2020
let width, height, ratio, padding, diffHeight, qualityMultiplier, filePath, fileData, hashString, counter;
2121

22+
const skipDownload = process.env.SKIP_DOWNLOAD === 'true';
23+
2224
const downloadFile = function(url, file_path, next) {
25+
if (skipDownload) {
26+
console.log('skipped')
27+
next();
28+
return;
29+
}
30+
2331
const fileStream = fs.createWriteStream(file_path);
2432

2533
fileStream.on('error', function(err) {

‎src/backend/templates/event.hbs

+10-10
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171
<div class="col-md-4">
7272
</div>
7373
<div class="ticket-button-container col-md-8">
74-
<a href="{{{eventurls.register}}}" id="ticket-button" class="pull-right btn btn-lg btn-primary" role="button">Tickets</a>
74+
<a href="{{eventurls.register}}" id="ticket-button" class="pull-right btn btn-lg btn-primary" role="button">Tickets</a>
7575
</div>
7676
</div>
7777
</div>
@@ -105,9 +105,9 @@
105105
<div class="speaker">
106106
<div class="image-holder">
107107
{{#if photo}}
108-
<img onError="this.onerror=null;this.src='./images/avatar.png';" data-original="{{{photo}}}" class="lazy background-image display-block" alt="{{{name}}}">
108+
<img onError="this.onerror=null;this.src='./images/avatar.png';" data-original="{{photo}}" class="lazy background-image display-block" alt="{{name}}">
109109
{{else}}
110-
<img class="background-image display-block" alt="{{{name}}}" src="images/avatar.png"/>
110+
<img class="background-image display-block" alt="{{name}}" src="images/avatar.png"/>
111111
{{/if}}
112112
<div class="responsive-overlay">
113113
<div class="hover-state text-center preserve3d">
@@ -154,7 +154,7 @@
154154
<div class="tweet-row">
155155
<div class="col-sm-12 col-md-12 col-xs-12">
156156
<i class ="social_twitter fa fa-twitter"></i>
157-
<div class="tweets-feed" id="tweets" data-count=50 data-query="{{{eventurls.twitterLink}}}" data-from="{{{eventurls.twitterLink}}}">
157+
<div class="tweets-feed" id="tweets" data-count=50 data-query="{{eventurls.twitterLink}}" data-from="{{eventurls.twitterLink}}">
158158
<div class="arrow-up"></div>
159159
<p id="tweet" class="tweet">
160160
Loading...
@@ -195,12 +195,12 @@
195195
<div class="row">
196196
{{#each sponsorpics}}
197197
{{#each this}}
198-
<div class="sponsor-row-text {{{divclass}}}">
199-
<div class=" {{{sponsorimg}}} text-center">
200-
<a href="{{{url}}}" data-toggle="tooltip" title="{{{type}}}">
201-
<img class="lazy centre {{{imgsize}}}" alt="{{{name}}}" data-original="{{{logo}}}">
198+
<div class="sponsor-row-text {{divclass}}">
199+
<div class="{{sponsorimg}} text-center">
200+
<a href="{{url}}" data-toggle="tooltip" title="{{type}}">
201+
<img class="lazy centre {{imgsize}}" alt="{{name}}" data-original="{{logo}}">
202202
</a>
203-
{{{name}}}
203+
{{name}}
204204
</div>
205205
</div>
206206
{{/each}}
@@ -235,7 +235,7 @@
235235
{{/if}}
236236
{{/if}}
237237

238-
<input type="hidden" id="mappos" value="{{{eventurls.latitude}}},{{{eventurls.longitude}}}"/>
238+
<input type="hidden" id="mappos" value="{{eventurls.latitude}},{{eventurls.longitude}}"/>
239239
<input type="hidden" id="theme" value={{theme}} />
240240
<input type="hidden" id="mapType" value={{map}} />
241241

‎src/backend/templates/partials/footer.hbs

+6-6
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<ul class="menu">
88
<li><a target="_self" href="index.html#description">About</a></li>
99
{{#if eventurls.register}}
10-
<li><a target="_self" href="{{{eventurls.register}}}">Tickets</a></li>
10+
<li><a target="_self" href="{{eventurls.register}}">Tickets</a></li>
1111
{{/if}}
1212
{{#if timeList}}
1313
<li><a target="_self" href="schedule.html">Schedule</a></li>
@@ -31,15 +31,15 @@
3131
{{#if copyright}}
3232
{{#if copyright.licence}}
3333
<p>
34-
<a href="{{{copyright.licence_url}}}"><img src="{{{copyright.logo}}}"></a>
34+
<a href="{{copyright.licence_url}}"><img src="{{copyright.logo}}"></a>
3535
&nbsp; &copy; {{copyright.year}}
3636
{{#if copyright.holder_url}}
37-
<a href="{{{copyright.holder_url}}}">{{copyright.holder}}.</a>
37+
<a href="{{copyright.holder_url}}">{{copyright.holder}}.</a>
3838
{{else}}
3939
{{copyright.holder}}.
4040
{{/if}}
4141
The website and its contents are licensed under
42-
<a href="{{{copyright.licence_url}}}"> {{copyright.licence}}. </a>
42+
<a href="{{copyright.licence_url}}"> {{copyright.licence}}. </a>
4343
The site was generated using the Open Event format on the <a href="https://eventyay.com/">eventyay</a> <a href="https://webgen.eventyay.com/">site generator</a>. Please submit issues <a href="https://github.com/fossasia/open-event-webapp/issues">here</a>.
4444
</p>
4545
{{/if}}
@@ -60,7 +60,7 @@
6060
{{#if eventurls.location}}
6161
<li class="address">
6262
<i class="fa fa-map-marker"></i>
63-
<div>{{{eventurls.orgname}}}&#44;&nbsp;{{eventurls.location}}</div>
63+
<div>{{eventurls.orgname}}&#44;&nbsp;{{eventurls.location}}</div>
6464
</li>
6565
{{/if}}
6666
</ul>
@@ -71,7 +71,7 @@
7171
<ul class="social-profiles">
7272
{{#sociallinks}}
7373
{{#if show}}
74-
<li class="pull-left social-icons"><a href="{{link}}" id="social-icons"><i class="fa fa-lg fa-{{icon}}" aria-hidden="true" title="{{{icon}}}"></i></a></li>
74+
<li class="pull-left social-icons"><a href="{{link}}" id="social-icons"><i class="fa fa-lg fa-{{icon}}" aria-hidden="true" title="{{icon}}"></i></a></li>
7575
{{/if}}
7676
{{/sociallinks}}
7777
</ul>

‎src/backend/templates/partials/navbar.hbs

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<ul class="dropdown-menu list-menu">
2323
{{#sociallinks}}
2424
{{#if show}}
25-
<li><a href="{{link}}" id="social-icons"><i class="fa fa-lg fa-{{icon}}" aria-hidden="true" title="{{{icon}}}"></i></a></li>
25+
<li><a href="{{link}}" id="social-icons"><i class="fa fa-lg fa-{{icon}}" aria-hidden="true" title="{{icon}}"></i></a></li>
2626
{{/if}}
2727
{{/sociallinks}}
2828
</ul>
@@ -115,7 +115,7 @@
115115

116116
{{#sociallinks}}
117117
{{#if show}}
118-
<li class="pull-left social-icons"><a href="{{link}}" id="social-icons"><i class="fa fa-lg fa-{{icon}}" aria-hidden="true" title="{{{icon}}}"></i></a></li>
118+
<li class="pull-left social-icons"><a href="{{link}}" id="social-icons"><i class="fa fa-lg fa-{{icon}}" aria-hidden="true" title="{{icon}}"></i></a></li>
119119
{{/if}}
120120
{{/sociallinks}}
121121

‎src/backend/templates/rooms.hbs

+6-6
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@
184184
<div class="margin-down-15">{{title}}
185185
</div>
186186
<div id="desc2-{{session_id}}" class="collapse in"
187-
style="background-color:{{{color}}}; color: {{{font_color}}};">
187+
style="background-color:{{color}}; color: {{font_color}};">
188188
<div class="row">
189189
{{#if speakers_list.length}}
190190
<div class="speakers-list">
@@ -257,22 +257,22 @@
257257
<div class="blacktext session-speaker-social margin-down-10">
258258
<div class="session-speakers-more">
259259
{{#if website}}
260-
<a class="blacktext social speaker-social" href="{{{website}}}"}>
260+
<a class="blacktext social speaker-social" href="{{website}}"}>
261261
<i class="fa fa-home"></i> Web
262262
</a>&nbsp;
263263
{{/if}}
264264
{{#if github}}
265-
<a class="blacktext social speaker-social" href="{{{github}}}"}>
265+
<a class="blacktext social speaker-social" href="{{github}}"}>
266266
<i class="fa fa-github"></i> Github
267267
</a>&nbsp;
268268
{{/if}}
269269
{{#if twitter}}
270-
<a class="blacktext social speaker-social" href="{{{twitter}}}"}>
270+
<a class="blacktext social speaker-social" href="{{twitter}}"}>
271271
<i class="fa fa-twitter"></i> Twitter
272272
</a>&nbsp;
273273
{{/if}}
274274
{{#if linkedin}}
275-
<a class="blacktext social speaker-social" href="{{{linkedin}}}"}>
275+
<a class="blacktext social speaker-social" href="{{linkedin}}"}>
276276
<i class="fa fa-linkedin"></i> LinkedIn
277277
</a>&nbsp;
278278
{{/if}}
@@ -307,7 +307,7 @@
307307
{{/if}}
308308
<p>
309309
<ul class="title-inline">
310-
<li style="background-color:{{{color}}}; color: {{{font_color}}};" class="titlecolor"></li>&nbsp;
310+
<li style="background-color:{{color}}; color: {{font_color}};" class="titlecolor"></li>&nbsp;
311311
<li class="blacktext track-name">{{tracktitle}}</li>
312312
</ul>
313313
</p><br>

0 commit comments

Comments
 (0)