lewis.moe
forked from
tangled.org/core
Monorepo for Tangled
appview/knots, appview/spindles: strip protocol and @ symbol from user inputs
Signed-off-by: Evan Jarrett <evan@evanjarrett.com>
authored by
Tangled
4f99f195
73964ab9
+9
appview/knots/knots.go
+9
appview/knots/knots.go
···
6
6
"log/slog"
7
7
"net/http"
8
8
"slices"
9
+
"strings"
9
10
"time"
10
11
11
12
"github.com/go-chi/chi/v5"
···
145
146
}
146
147
147
148
domain := r.FormValue("domain")
149
+
// Strip protocol, trailing slashes, and whitespace
150
+
// Rkey cannot contain slashes
151
+
domain = strings.TrimSpace(domain)
152
+
domain = strings.TrimPrefix(domain, "https://")
153
+
domain = strings.TrimPrefix(domain, "http://")
154
+
domain = strings.TrimSuffix(domain, "/")
148
155
if domain == "" {
149
156
k.Pages.Notice(w, noticeId, "Incomplete form.")
150
157
return
···
526
533
}
527
534
528
535
member := r.FormValue("member")
536
+
member = strings.TrimPrefix(member, "@")
529
537
if member == "" {
530
538
l.Error("empty member")
531
539
k.Pages.Notice(w, noticeId, "Failed to add member, empty form.")
···
626
634
}
627
635
628
636
member := r.FormValue("member")
637
+
member = strings.TrimPrefix(member, "@")
629
638
if member == "" {
630
639
l.Error("empty member")
631
640
k.Pages.Notice(w, noticeId, "Failed to remove member, empty form.")
+1
-1
appview/pages/templates/knots/fragments/addMemberModal.html
+1
-1
appview/pages/templates/knots/fragments/addMemberModal.html
+1
-1
appview/pages/templates/repo/settings/access.html
+1
-1
appview/pages/templates/repo/settings/access.html
+1
-1
appview/pages/templates/spindles/fragments/addMemberModal.html
+1
-1
appview/pages/templates/spindles/fragments/addMemberModal.html
+9
appview/spindles/spindles.go
+9
appview/spindles/spindles.go
···
6
6
"log/slog"
7
7
"net/http"
8
8
"slices"
9
+
"strings"
9
10
"time"
10
11
11
12
"github.com/go-chi/chi/v5"
···
146
147
}
147
148
148
149
instance := r.FormValue("instance")
150
+
// Strip protocol, trailing slashes, and whitespace
151
+
// Rkey cannot contain slashes
152
+
instance = strings.TrimSpace(instance)
153
+
instance = strings.TrimPrefix(instance, "https://")
154
+
instance = strings.TrimPrefix(instance, "http://")
155
+
instance = strings.TrimSuffix(instance, "/")
149
156
if instance == "" {
150
157
s.Pages.Notice(w, noticeId, "Incomplete form.")
151
158
return
···
484
491
}
485
492
486
493
member := r.FormValue("member")
494
+
member = strings.TrimPrefix(member, "@")
487
495
if member == "" {
488
496
l.Error("empty member")
489
497
s.Pages.Notice(w, noticeId, "Failed to add member, empty form.")
···
613
621
}
614
622
615
623
member := r.FormValue("member")
624
+
member = strings.TrimPrefix(member, "@")
616
625
if member == "" {
617
626
l.Error("empty member")
618
627
s.Pages.Notice(w, noticeId, "Failed to remove member, empty form.")