storm/bragi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3 from BafDyce/fix-html-injection

Browse Source 
[Web Interface] Fix HTML injection via "currently playing"
This commit is contained in:
Fabian Würfl 2018-05-21 11:25:35 +02:00 committed by GitHub
commit 6beed76ba5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
interface.py
View File

@ -98,21 +98,29 @@ def index():
random.shuffle(var.playlist)
if var.current_music:
source = var.current_music[0]
# format for current_music below:
# (sourcetype, title, url or None)
if source == "radio":
current_music = "[radio] {title} sur {url}".format(
title=media.get_radio_title(var.current_music[1]),
url=var.current_music[2]
current_music = (
"[radio]",
media.get_radio_title(var.current_music[1]),
var.current_music[2]
)
elif source == "url":
current_music = "[url] {title} (<a href=\"{url}\">{url}</a>)".format(
title=var.current_music[2],
url=var.current_music[1]
current_music = (
"[url]",
var.current_music[2],
var.current_music[1]
)
elif source == "file":
current_music = "[file] {title}".format(title=var.current_music[2])
current_music = (
"[file]",
var.current_music[2],
None
)
else:
current_music = "(?)[{}] {} {}".format(
var.current_music[0],
current_music = (
"(??)[" + var.current_music[0] + "]",
var.current_music[1],
var.current_music[2],
)

5
templates/index.html
View File

@ -77,7 +77,10 @@
<div id="playlist">
Currently Playing :
{% if current_music %}
{{ current_music|safe }}
{{ current_music[0] }} {{ current_music[1] }}
{% if current_music[2] %}
(<a href="{{ current_music[2] }}">{{ current_music[2] }}</a>)
{% endif %}
{% else %}
No music
{% endif %}