Ailur-Archives
/
burgercat
Archived
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

burger

This commit is contained in:
maaa 2023-07-10 00:02:45 +02:00
parent 4550143f00
commit b80ae16889
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
main
View File

@ -159,7 +159,7 @@ def user(pageusername):
@app.route("/api/page/<userid>", methods=("GET", "POST")) @app.route("/api/page/<userid>", methods=("GET", "POST"))
def apipageuser(userid): def apipageuser(userid):
pageuser = get_user(userid) pageuser = get_user(userid)
addhtml = """<head><meta http-equiv="Content-Security-Policy" default-src='none'; content="img-src cdn.discordapp.com media.tenor.com; style-src: 'self'" /></head>""" addhtml = """<base target="_blank"/> <head><meta http-equiv="Content-Security-Policy" default-src='none'; content="img-src cdn.discordapp.com cdn.discordapp.net media.tenor.com; style-src: 'self';" /></head>"""
if not pageuser == "error": if not pageuser == "error":
return addhtml + pageuser["htmldescription"] return addhtml + pageuser["htmldescription"]
@ -179,7 +179,7 @@ def edituser(pageusername):
user = get_user(userCookie["id"]) user = get_user(userCookie["id"])
if pageuser["username"] == user["username"]: if pageuser["username"] == user["username"]:
if request.method == "POST": if request.method == "POST":
code = request.form["code"].replace("Content-Security-Policy", "") code = request.form["code"].replace("Content-Security-Policy", "").replace("<iframe>", "")
conn = get_db_connection() conn = get_db_connection()
conn.execute("UPDATE users SET htmldescription = ? WHERE id = ?", conn.execute("UPDATE users SET htmldescription = ? WHERE id = ?",
(code, user["id"])) (code, user["id"]))
@ -441,6 +441,7 @@ def comment():
@app.route("/cdn/<filename>", methods=("GET", "POST")) @app.route("/cdn/<filename>", methods=("GET", "POST"))
@limiter.limit("8/second", override_defaults=False)
def cdn(filename): def cdn(filename):
if os.path.exists(os.path.join(UPLOAD_FOLDER, filename)): if os.path.exists(os.path.join(UPLOAD_FOLDER, filename)):
return send_from_directory(UPLOAD_FOLDER, filename) return send_from_directory(UPLOAD_FOLDER, filename)