discourse
/
discourse-calendar
mirror of https://github.com/discourse/discourse-calendar.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FIX: skip html escaping event urls (#473)

This commit is contained in:
Renato Atilio 2023-11-08 17:43:11 -03:00 committed by GitHub
parent f9f8e9d719
commit 1a97a946ce
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/discourse_post_event/event_parser.rb
View File

@ -41,7 +41,7 @@ module DiscoursePostEvent
if value && valid_options.include?(name) if value && valid_options.include?(name)
event ||= {} event ||= {}
event[name.sub("data-", "").to_sym] = if name == "data-name" event[name.sub("data-", "").to_sym] = if %w[data-name data-url].include?(name)
value value
else else
CGI.escapeHTML(value) CGI.escapeHTML(value)

10
spec/lib/discourse_post_event/event_parser_spec.rb
View File

@ -100,6 +100,16 @@ describe DiscoursePostEvent::EventParser do
expect(events[0][:name]).to eq("bar <script> baz") expect(events[0][:name]).to eq("bar <script> baz")
end end
it "doesn't escape urls" do
post_event = build_post user, <<~TXT
[event start="2020" url="https://example.com/?q=foo&all=true"]
[/event]
TXT
events = parser.extract_events(post_event)
expect(events[0][:url]).to eq("https://example.com/?q=foo&all=true")
end
context "with custom fields" do context "with custom fields" do
before { SiteSetting.discourse_post_event_allowed_custom_fields = "foo-bar|bar" } before { SiteSetting.discourse_post_event_allowed_custom_fields = "foo-bar|bar" }