2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-06 10:50:21 +08:00

FIX: Don't add a slug to constructed quote urls (#12052)

A topic with the slug 'topic' might exist and may end up being linked to
by mistake when malformed (i.e. cross-site) quotes are posted.
This commit is contained in:
Daniel Waterworth 2021-02-11 12:21:13 -06:00 committed by GitHub
parent 578f753a13
commit df8436cd7f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 4 deletions

View file

@ -333,7 +333,7 @@ module PrettyText
# extract quotes # extract quotes
doc.css("aside.quote[data-topic]").each do |aside| doc.css("aside.quote[data-topic]").each do |aside|
if aside["data-topic"].present? if aside["data-topic"].present?
url = +"/t/topic/#{aside["data-topic"]}" url = +"/t/#{aside["data-topic"]}"
url << "/#{aside["data-post"]}" if aside["data-post"].present? url << "/#{aside["data-post"]}" if aside["data-post"].present?
links << DetectedLink.new(url, true) links << DetectedLink.new(url, true)
end end

View file

@ -706,7 +706,7 @@ describe PrettyText do
end end
it "should extract links to topics" do it "should extract links to topics" do
expect(extract_urls("<aside class=\"quote\" data-topic=\"321\">aside</aside>")).to eq(["/t/topic/321"]) expect(extract_urls("<aside class=\"quote\" data-topic=\"321\">aside</aside>")).to eq(["/t/321"])
end end
it "should lazyYT videos" do it "should lazyYT videos" do
@ -714,7 +714,7 @@ describe PrettyText do
end end
it "should extract links to posts" do it "should extract links to posts" do
expect(extract_urls("<aside class=\"quote\" data-topic=\"1234\" data-post=\"4567\">aside</aside>")).to eq(["/t/topic/1234/4567"]) expect(extract_urls("<aside class=\"quote\" data-topic=\"1234\" data-post=\"4567\">aside</aside>")).to eq(["/t/1234/4567"])
end end
it "should not extract links to anchors" do it "should not extract links to anchors" do
@ -734,7 +734,7 @@ describe PrettyText do
expect(links.map { |l| [l.url, l.is_quote] }.sort).to eq([ expect(links.map { |l| [l.url, l.is_quote] }.sort).to eq([
["http://body_only.com", false], ["http://body_only.com", false],
["http://body_and_quote.com", false], ["http://body_and_quote.com", false],
["/t/topic/1234", true], ["/t/1234", true],
].sort) ].sort)
end end