From d156c81a66d1f556fc86d8c9c6794bf5bf2ce5e8 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Jun 19 2019 10:32:38 +0000 Subject: [PATCH 1/5] Change the way we sanitize the blamed view We used to sanitize the entire content of the filter blame_loc which builds the html table with the git blame view. This sanitization removes all src in img tag that do not point to this pagure instance, in other words, it removes all the avatars making the page not really nice to see. In this commit, we clean each line in the file that is being blamed while building the html table instead of cleaning the entire table at once. Signed-off-by: Pierre-Yves Chibon --- diff --git a/pagure/templates/blame.html b/pagure/templates/blame.html index 9784a3d..d97c43b 100644 --- a/pagure/templates/blame.html +++ b/pagure/templates/blame.html @@ -152,7 +152,7 @@ {% autoescape false %} - {{ content | blame_loc(repo, username, blame) | noJS | safe }} + {{ content | blame_loc(repo, username, blame) }} {% endautoescape %} {% else %} diff --git a/pagure/ui/filters.py b/pagure/ui/filters.py index 448eb98..1168963 100644 --- a/pagure/ui/filters.py +++ b/pagure/ui/filters.py @@ -476,7 +476,7 @@ def blame_loc(loc, repo, username, blame): ) ) output.append( - '
%s
' % line + '
%s
' % no_js(line) ) output.append("") From 3ff7043557d183bc0d1e52685229b8d323b88f02 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Jun 19 2019 10:32:38 +0000 Subject: [PATCH 2/5] More CSP fixes - Be consistent on how we call javascript and css files, always use a nonce even when not really needed. - Drop all the inline style="" in favor of CSS class and ID and sometime with a little JS magic - Remove all the href="javascrip:void(0)" Signed-off-by: Pierre-Yves Chibon --- diff --git a/pagure/static/issue_ev.js b/pagure/static/issue_ev.js index 0e483a2..6f7b41f 100644 --- a/pagure/static/issue_ev.js +++ b/pagure/static/issue_ev.js @@ -71,7 +71,7 @@ unassigne_issue = function(data) { var field = $('#assignee_plain'); var _html = '
None'; if ( data.comment_user == username) { - _html = _html + ' — Take' + _html = _html + ' — Take' } _html = _html + '
'; field.html(_html); @@ -162,8 +162,8 @@ add_comment = function(data, username) { + '
' + '
' + '
' - + ' ' + + ' ' + ' ' + ' '; if ( data.comment_user == username) { diff --git a/pagure/static/pagure.css b/pagure/static/pagure.css index dac79e7..37f9d2e 100644 --- a/pagure/static/pagure.css +++ b/pagure/static/pagure.css @@ -246,7 +246,8 @@ a.notblue { box-shadow: 0 0 5px #999; } -pre.softwrap +pre.softwrap, +.softwrap { white-space: pre-wrap; word-wrap: break-word; @@ -264,6 +265,10 @@ th[data-sort] { display: none; } +.progress-bar { + line-height: 2em; +} + .code_table .cell_commit{ padding-left:0.5em; } @@ -361,18 +366,144 @@ th[data-sort] { .selectize-control:before{ - -webkit-animation: fa-spin 2s infinite linear; + -webkit-animation: fa-spin 2s infinite linear; animation: fa-spin 2s infinite linear; - content: '\f1ce'; + content: '\f1ce'; font-family: FontAwesome; - z-index: 2; - position: absolute; - display: block; - right: 34px; + z-index: 2; + position: absolute; + display: block; + right: 34px; top: 7px; - opacity: 0; + opacity: 0; } .selectize-control.loading:before{ opacity:0.4; } + +.font-0.9em { + font-size:0.9em; +} + +.font-1em { + font-size: 1em; +} + +.font-90p { + font-size: 90%; +} + +.inline { + display: inline; +} + +.inline-block { + display: inline-block; +} + +#PR-dropdown, +#filters-dropdown, +#merge-alert { + min-width:400px; +} + +#source-dropdown, +#sort-dropdown, +#filters-list-dropdown, +#archive_format_dropdown { + width:300px; +} + +#maintainers_dropdown { + width:500px; +} + +#issue_templates_dropdown { + position: absolute; + transform: translate3d(-110px, 31px, 0px); + top: 0px; + left: 0px; + will-change: transform; +} + +.pointer { + cursor: pointer; +} + +.badge-tag { + width:100%; + display:block; +} + +.width-40p { + width:40px; +} + +.width-60p { + width:60px; +} + +.width-150p { + width:150px; +} + +.width-100per { + width:100%; +} + +.height-22p { + height:22px; +} + +.height-8p { + height:8px +} + +.height-100per { + height: 100% +} + +.text-align-right { + text-align:right; +} + +.center { + text-align:center; +} + +.justify { + text-align:justify; +} + +.new_commit { + position:absolute; + left:-2em; + top:0; + padding:5px; + padding-top:20px; + height:100%; + vertical-align:middle; +} + +#docframe { + min-height:700px; + width:100% +} + +.commit_hash { + font-size: 1em; + background: #ddd; +} + +.light_gray_bg { + background-color:#ccc; +} + +.font-monospace { + font-family:monospace +} + +.flex-1{ + flex:1; +} diff --git a/pagure/templates/_formhelper.html b/pagure/templates/_formhelper.html index e89c862..f33e3f3 100644 --- a/pagure/templates/_formhelper.html +++ b/pagure/templates/_formhelper.html @@ -159,8 +159,8 @@ {% if g.fas_user %} - + {% endif %} @@ -251,8 +251,8 @@
{% if g.fas_user %} - + {% endif %} @@ -315,7 +315,7 @@
{% if g.fas_user %} - Reply diff --git a/pagure/templates/_render_issues.html b/pagure/templates/_render_issues.html index 1a4f803..6b6bb57 100644 --- a/pagure/templates/_render_issues.html +++ b/pagure/templates/_render_issues.html @@ -28,7 +28,7 @@ {% endif %}
- +
{% if issue.assignee %} @@ -111,8 +111,8 @@ {% for tag in issue.tags %} {% if filterstatus %} + data-bg-color="{{ tag.tag_color}}" + class="badge badge-secondary font-90p small-badge-tag"> {{ tag.tag }} {% endif %} diff --git a/pagure/templates/_render_pullrequests.html b/pagure/templates/_render_pullrequests.html index d28d462..23d59ce 100644 --- a/pagure/templates/_render_pullrequests.html +++ b/pagure/templates/_render_pullrequests.html @@ -134,8 +134,8 @@
{% for tag in request.tags %} + data-bg-color="{{ tag.tag_color}}" + class="badge badge-secondary font-90p badge-tag"> {{ tag.tag }} {% endfor %} diff --git a/pagure/templates/_render_repo.html b/pagure/templates/_render_repo.html index 88ab963..cfd0bb8 100644 --- a/pagure/templates/_render_repo.html +++ b/pagure/templates/_render_repo.html @@ -3,7 +3,7 @@ {% macro searchbox(select) %}
- @@ -18,7 +18,7 @@ elif select=='users' %} Search Users {% elif select=='groups'%} Search Groups{% endif %}" class="form-control" title="Search" /> - +
{% endmacro%} @@ -58,7 +58,7 @@ created {{repo.date_created|humanize}} -
+
{{repo.forks|count}} @@ -257,11 +257,11 @@ src="{{ repo.avatar_email | avatar_url }}" width=60 height=60 /> {% elif repo.is_fork %} -
+
{% else %} -
+
{% endif %} @@ -294,18 +294,17 @@ {% endmacro %} {% macro render_activity_graph(username, _class="") %} - - - - - -
diff --git a/pagure/templates/_repo_renderdiff.html b/pagure/templates/_repo_renderdiff.html index 6e93217..a092216 100644 --- a/pagure/templates/_repo_renderdiff.html +++ b/pagure/templates/_repo_renderdiff.html @@ -77,7 +77,8 @@ {% endmacro %} {% macro diffcollapsebtn(loop)%} - + {% endmacro %} diff --git a/pagure/templates/activity.html b/pagure/templates/activity.html index 938d77c..ec5938f 100644 --- a/pagure/templates/activity.html +++ b/pagure/templates/activity.html @@ -9,10 +9,10 @@
-
\ +
\ "+item["meta"]["subtitle"]+"\
"); } @@ -143,7 +143,7 @@ function processMessages(item, lastitem) { .append(" to "+item["msg"]["issue"]["assignee"]["name"]); } else { $(messagedetail).html("\ -
\ +
\ "+item["meta"]["subtitle"]+"\
\ "); @@ -164,7 +164,7 @@ function processMessages(item, lastitem) {
"); } else { $("#messages").append("\ -
\ +
\ "+item["meta"]["subtitle"]+"\
"); } @@ -202,14 +202,14 @@ function processMessages(item, lastitem) { return "GITCOMMIT#"+item["msg"]["commit"]["branch"]; } else { $("#messages").append("\ -
\ +
\ "+item["meta"]["subtitle"]+"\
"); } return ""; } else { $("#messages").append("\ -
\ +
\ "+item["meta"]["subtitle"]+"\
"); return ""; diff --git a/pagure/templates/add_deploykey.html b/pagure/templates/add_deploykey.html index 058d4a6..fa152aa 100644 --- a/pagure/templates/add_deploykey.html +++ b/pagure/templates/add_deploykey.html @@ -4,8 +4,8 @@ {% set tag = "home" %} {% block header %} - + {% endblock %} {% block title %}Add deploy key - {{ diff --git a/pagure/templates/add_group_project.html b/pagure/templates/add_group_project.html index cf4a33b..f792f05 100644 --- a/pagure/templates/add_group_project.html +++ b/pagure/templates/add_group_project.html @@ -3,8 +3,8 @@ {% set tag = "groups" %} {% block header %} - + {% endblock %} {% block title %}Add group - {{ @@ -27,8 +27,7 @@
+ placeholder="Start typing to search groups" value=""/> + placeholder="Start typing to search users" value=""/>
'; + + ' — Drop
'; $('#assignee_plain').html(_user_url); $('#assignee').val("{{ g.fas_user.username }}"); setup_btn_take_drop(); @@ -1002,7 +1011,8 @@ function drop_issue(){ $.post( _url, _data ).done( function(data) { var _user_url = '
\nNone' - + ' — Take
'; + + ' — Take
'; $('#assignee_plain').html(_user_url); $('#assignee').val(""); setup_btn_take_drop(); @@ -1028,43 +1038,41 @@ function setup_btn_take_drop(){ $( document ).ready(function() { -$(".close_status_dropdown_action").click(function(event){ - var status = "{{issue.status}}"; - if (status == "Open") { - $("#changestatusform #statusform_status").val("Closed"); - $("#changestatusform #statusform_close_status").val($(this).attr("data-value")); - } else { - $("#changestatusform #statusform_status").val("Open"); - } - $("#changestatusform #statusform_assignee").val($("#assignee").val()); - $("#changestatusform #statusform_tag").val($("#tag").val()); - $("#changestatusform #statusform_priority").val($("#priority").val()); - $("#changestatusform #statusform_milestone").val($("#milestone").val()); - $("#changestatusform #statusform_blocking").val($("#blocking").val()); - $("#changestatusform #statusform_depending").val($("#depending").val()); - - {% if repo.issue_keys %} - {% for field in repo.issue_keys %} - $("#changestatusform #statusform_{{ field.name | replace(' ', '_') }}").val($("#{{ field.name | replace(' ', '_') }}").val()); - {% endfor %} - {% endif %} - $("#changestatusform").submit(); - -}); - -$(".comment_and_close_action").click(function(event){ - var status = "{{issue.status}}"; - if (status == "Open") { - $(".mainform #status").val("Closed"); - $(".mainform #close_status").val($(this).attr("data-value")); - } else { - $(".mainform #status").val("Open"); - } - $(".mainform").submit(); + $(".close_status_dropdown_action").click(function(event){ + var status = "{{issue.status}}"; + if (status == "Open") { + $("#changestatusform #statusform_status").val("Closed"); + $("#changestatusform #statusform_close_status").val($(this).attr("data-value")); + } else { + $("#changestatusform #statusform_status").val("Open"); + } + $("#changestatusform #statusform_assignee").val($("#assignee").val()); + $("#changestatusform #statusform_tag").val($("#tag").val()); + $("#changestatusform #statusform_priority").val($("#priority").val()); + $("#changestatusform #statusform_milestone").val($("#milestone").val()); + $("#changestatusform #statusform_blocking").val($("#blocking").val()); + $("#changestatusform #statusform_depending").val($("#depending").val()); + + {% if repo.issue_keys %} + {% for field in repo.issue_keys %} + $("#changestatusform #statusform_{{ field.name | replace(' ', '_') }}").val($("#{{ field.name | replace(' ', '_') }}").val()); + {% endfor %} + {% endif %} + $("#changestatusform").submit(); -}); + }); + $(".comment_and_close_action").click(function(event){ + var status = "{{issue.status}}"; + if (status == "Open") { + $(".mainform #status").val("Closed"); + $(".mainform #close_status").val($(this).attr("data-value")); + } else { + $(".mainform #status").val("Open"); + } + $(".mainform").submit(); + }); var emojiStrategy; @@ -1277,8 +1285,10 @@ $( "#previewinmarkdown" ).click( {% if repo.quick_replies %} - + {% endif %} - + {% endblock %} diff --git a/pagure/templates/issues.html b/pagure/templates/issues.html index a70ba38..bae0d99 100644 --- a/pagure/templates/issues.html +++ b/pagure/templates/issues.html @@ -8,9 +8,9 @@ {% set tag = "home"%} {% block header %} - -