deepcrayon/lila
deepcrayon/lila
1
0
Fork 0
Code Releases Activity

fix escaping in opengraph descriptions - #632

Browse source
This commit is contained in:
Thibault Duplessis 2015-07-07 22:58:18 +02:00
parent 2bf4384832
commit ed6acc8e5f
3 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/templating/StringHelper.scala
View file

@ -32,7 +32,8 @@ trait StringHelper { self: NumberHelper =>
// the replace quot; -> " is required
// to avoid issues caused by addLinks
// when an url is surrounded by quotes
def escape(text: String) = escapeHtml4(text).replace(""", "\"")
def escape(text: String) = escapeEvenDoubleQuotes(text).replace(""", "\"")
def escapeEvenDoubleQuotes(text: String) = escapeHtml4(text)
def nl2br(text: String) = text.replace("\r\n", "<br />").replace("\n", "<br />")

3
app/ui/OpenGraph.scala
View file

@ -2,6 +2,7 @@ package lila.app
package ui
import play.twirl.api.Html
import org.apache.commons.lang3.StringEscapeUtils.escapeHtml4
case class OpenGraph(
title: String,
@ -15,7 +16,7 @@ case class OpenGraph(
def html = Html(toString)
private def tag(name: String, value: String) =
s"""<meta property="og:$name" content="$value" />"""
s"""<meta property="og:$name" content="${escapeHtml4(value)}" />"""
private val tupledTag = (tag _).tupled

2
app/views/base/layout.scala.html
View file

@ -27,7 +27,7 @@ withLangAnnotations: Boolean = true)(body: Html)(implicit ctx: Context)
@cssTag("board.css")
@moreCss
<link id="piece-sprite" href="@staticUrl(s"stylesheets/piece/${ctx.currentPieceSet}.css?v=$assetVersion")" type="text/css" rel="stylesheet"/>
<meta content="@openGraph.fold(trans.freeOnlineChessGamePlayChessNowInACleanInterfaceNoRegistrationNoAdsNoPluginRequiredPlayChessWithComputerFriendsOrRandomOpponents())(o => Html(o.description))" name="description">
<meta content="@openGraph.fold(trans.freeOnlineChessGamePlayChessNowInACleanInterfaceNoRegistrationNoAdsNoPluginRequiredPlayChessWithComputerFriendsOrRandomOpponents())(o => Html(escapeEvenDoubleQuotes(o.description)))" name="description">
<link rel="shortcut icon" href="@staticUrl("images/favicon-32-white.png")" type="image/x-icon" />
@if(!robots) {
<meta content="noindex, nofollow" name="robots">