Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MOBILE-3733 core: Sanitize offline data in format-text #4321

Merged
merged 1 commit into from
Feb 20, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/addons/blog/pages/index/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -46,14 +46,14 @@ <h1>{{ title | translate }}</h1>
<div class="entry-subject flex ion-text-wrap ion-justify-content-between ion-align-items-center">
<h3>
<core-format-text [text]="entry.subject" [contextLevel]="contextLevel" [contextInstanceId]="contextInstanceId"
[courseId]="entry.courseid" />
[courseId]="entry.courseid" [sanitize]="entryHasOfflineData(entry)" />
@if (entry.userid === currentUserId && entry.publishTranslated === 'publishtonoone') {
<span class="entry-draft">
<ion-badge color="warning"> {{ 'addon.blog.publishtonoone' | translate }} </ion-badge>
</span>
}

@if (!getEntryId(entry) || entry.updatedOffline) {
@if (entryHasOfflineData(entry)) {
<span class="entry-draft">
<ion-badge color="light">
<ion-icon name="fas-clock" [attr.aria-label]="'core.lastmodified' | translate" />
Expand Down Expand Up @@ -95,7 +95,8 @@ <h3>
<div class="entry-summary" [collapsible-item]="64">
<div class="ion-margin-bottom">
<core-format-text [text]="entry.summary" [component]="component" [componentId]="getEntryId(entry)"
[contextLevel]="contextLevel" [contextInstanceId]="contextInstanceId" [courseId]="entry.courseid" />
[contextLevel]="contextLevel" [contextInstanceId]="contextInstanceId" [courseId]="entry.courseid"
[sanitize]="entryHasOfflineData(entry)" />
</div>

@if (tagsEnabled && entry.tags && entry.tags!.length > 0) {
Expand Down
10 changes: 10 additions & 0 deletions src/addons/blog/pages/index/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,16 @@ export default class AddonBlogIndexPage implements OnInit, OnDestroy {
return this.isOnlineEntry(entry) ? entry.id : undefined;
}

/**
* Whether an entry has offline data.
*
* @param entry Entry.
* @returns Whether it has offline data.
*/
entryHasOfflineData(entry: AddonBlogPostFormatted | AddonBlogOfflinePostFormatted): boolean {
return !this.isOnlineEntry(entry) || !!entry.updatedOffline;
}

/**
* Fetch blog entries.
*
Expand Down
2 changes: 1 addition & 1 deletion src/addons/calendar/pages/day/day.html
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ <h2>{{ periodName }}</h2>
</span>
<p class="item-heading">
<core-format-text [text]="event.name" [contextLevel]="event.contextLevel"
[contextInstanceId]="event.contextInstanceId" />
[contextInstanceId]="event.contextInstanceId" [sanitize]="event.offline" />
</p>
<p>
<core-format-text [text]="event.formattedtime" [filter]="false" />
Expand Down
9 changes: 5 additions & 4 deletions src/addons/calendar/pages/event/event.html
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@
</ion-buttons>
<ion-title>
<h1 *ngIf="event">
<core-format-text [text]="event.name" [contextLevel]="event.contextLevel" [contextInstanceId]="event.contextInstanceId" />
<core-format-text [text]="event.name" [contextLevel]="event.contextLevel" [contextInstanceId]="event.contextInstanceId"
[sanitize]="event.offline" />
</h1>
</ion-title>
<ion-buttons slot="end">
Expand Down Expand Up @@ -41,7 +42,7 @@ <h1 *ngIf="event">
</span>
<h1>
<core-format-text [text]="event.name" [contextLevel]="event.contextLevel"
[contextInstanceId]="event.contextInstanceId" />
[contextInstanceId]="event.contextInstanceId" [sanitize]="event.offline" />
</h1>
</ion-label>
</ion-item>
Expand Down Expand Up @@ -96,7 +97,7 @@ <h1>
<p class="item-heading">{{ 'core.description' | translate}}</p>
<p>
<core-format-text [text]="event.description" [contextLevel]="event.contextLevel"
[contextInstanceId]="event.contextInstanceId" />
[contextInstanceId]="event.contextInstanceId" [sanitize]="event.offline" />
</p>
</ion-label>
</ion-item>
Expand All @@ -106,7 +107,7 @@ <h1>
<p>
<a [href]="event.encodedLocation" core-link [autoLogin]="false">
<core-format-text [text]="event.location" [contextLevel]="event.contextLevel"
[contextInstanceId]="event.contextInstanceId" />
[contextInstanceId]="event.contextInstanceId" [sanitize]="event.offline" />
</a>
</p>
</ion-label>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
<h2>{{ plugin.name }}</h2>
<p>
<core-format-text [component]="component" [componentId]="assign.cmid" collapsible-item [text]="text" contextLevel="module"
[contextInstanceId]="assign.cmid" [courseId]="assign.course" />
[contextInstanceId]="assign.cmid" [courseId]="assign.course" [sanitize]="!isSent" />
</p>
</ion-label>
<div slot="end">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ <h2>{{ plugin.name }}</h2>
<p *ngIf="words">{{ 'addon.mod_assign.numwords' | translate: {'$a': words} }}</p>
<p>
<core-format-text [component]="component" [componentId]="assign.cmid" collapsible-item [text]="text" contextLevel="module"
[contextInstanceId]="assign.cmid" [courseId]="assign.course" />
[contextInstanceId]="assign.cmid" [courseId]="assign.course" [sanitize]="!isSent" />
</p>
</ion-label>
</ion-item>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ export class AddonModAssignSubmissionOnlineTextComponent extends AddonModAssignS
wordLimitEnabled = false;
currentUserId: number;
wordLimit = 0;
isSent = false;

protected wordCountTimeout?: number;
protected element: HTMLElement;
Expand Down Expand Up @@ -80,10 +81,12 @@ export class AddonModAssignSubmissionOnlineTextComponent extends AddonModAssignS
// Offline submission, get text if submission is not removed.
if (offlineData.plugindata.onlinetext_editor) {
this.text = (<AddonModAssignSubmissionOnlineTextPluginData>offlineData.plugindata).onlinetext_editor.text;
this.isSent = false;
}
} else {
// No offline data found, return online text.
this.text = AddonModAssign.getSubmissionPluginText(this.plugin);
this.isSent = true;
}

// Set the text.
Expand Down
2 changes: 2 additions & 0 deletions src/addons/mod/data/classes/base-field-plugin-component.ts
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ import { FormGroup, FormBuilder, Validators } from '@angular/forms';
import { CoreFormFields } from '@singletons/form';
import { AddonModDataData, AddonModDataEntryField, AddonModDataField } from '../services/data';
import { AddonModDataTemplateMode } from '../constants';
import { toBoolean } from '@/core/transforms/boolean';

/**
* Base class for component to render a field.
Expand All @@ -33,6 +34,7 @@ export abstract class AddonModDataFieldPluginBaseComponent implements OnInit, On
@Input() error?: string; // Error when editing.
@Input() form?: FormGroup; // Form where to add the form control. Just required for edit and search modes.
@Input() searchFields?: CoreFormFields; // The search value of all fields.
@Input({ transform: toBoolean }) recordHasOffline = false; // Whether the record this field belongs to has offline data.
@Output() gotoEntry = new EventEmitter<number>(); // Action to perform.
// Output called when the field is initialized with a value and it didn't have one already.
@Output() onFieldInit = new EventEmitter<AddonModDataEntryFieldInitialized>();
Expand Down
4 changes: 4 additions & 0 deletions src/addons/mod/data/components/field-plugin/field-plugin.ts
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import { AddonModDataData, AddonModDataField } from '../../services/data';
import { AddonModDataFieldsDelegate } from '../../services/data-fields-delegate';
import { AddonModDataTemplateMode } from '../../constants';
import { CoreSharedModule } from '@/core/shared.module';
import { toBoolean } from '@/core/transforms/boolean';

/**
* Component that displays a database field plugin.
Expand All @@ -44,6 +45,7 @@ export class AddonModDataFieldPluginComponent implements OnInit, OnChanges {
@Input() error?: string; // Error when editing.
@Input() form?: FormGroup; // Form where to add the form control. Just required for edit and search modes.
@Input() searchFields?: CoreFormFields; // The search value of all fields.
@Input({ transform: toBoolean }) recordHasOffline = false; // Whether the record this field belongs to has offline data.
@Output() gotoEntry = new EventEmitter<number>(); // Action to perform.
// Output called when the field is initialized with a value and it didn't have one already.
@Output() onFieldInit = new EventEmitter<AddonModDataEntryFieldInitialized>();
Expand Down Expand Up @@ -76,6 +78,7 @@ export class AddonModDataFieldPluginComponent implements OnInit, OnChanges {
error: this.error,
form: this.form,
searchFields: this.searchFields,
recordHasOffline: this.recordHasOffline,
gotoEntry: this.gotoEntry,
onFieldInit: this.onFieldInit,
};
Expand Down Expand Up @@ -109,6 +112,7 @@ export type AddonDataFieldPluginComponentData = {
error?: string; // Error when editing.
form?: FormGroup; // Form where to add the form control. Just required for edit and search modes.
searchFields?: CoreFormFields; // The search value of all fields.
recordHasOffline?: boolean; // Whether the record this field belongs to has offline data.
gotoEntry: EventEmitter<number>;
onFieldInit: EventEmitter<AddonModDataEntryFieldInitialized>;
};
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,4 @@
</span>

<core-format-text *ngIf="displayMode && value" [text]="format(value)" [component]="component" [componentId]="componentId"
contextLevel="module" [contextInstanceId]="componentId" [courseId]="database!.course" />
contextLevel="module" [contextInstanceId]="componentId" [courseId]="database!.course" [sanitize]="recordHasOffline" />
7 changes: 4 additions & 3 deletions src/addons/mod/data/pages/edit/edit.ts
Original file line number Diff line number Diff line change
Expand Up @@ -455,9 +455,10 @@ export default class AddonModDataEditPage implements OnInit {
let replaceRegEx = new RegExp(replace, 'gi');

// Replace field by a generic directive.
const render = '<addon-mod-data-field-plugin [class.has-errors]="!!errors[' + field.id + ']" mode="edit" \
[field]="fields[' + field.id + ']" [value]="contents[' + field.id + ']" [form]="form" [database]="database" \
[error]="errors[' + field.id + ']" (onFieldInit)="onFieldInit($event)"></addon-mod-data-field-plugin>';
const render = `<addon-mod-data-field-plugin [class.has-errors]="!!errors[${field.id}]" mode="edit" \
[field]="fields[${field.id}]" [value]="contents[${field.id}]" [form]="form" [database]="database" \
[error]="errors[${field.id}]" [recordHasOffline]="${this.entry?.hasOffline ? 'true' : 'false'}" \
(onFieldInit)="onFieldInit($event)"></addon-mod-data-field-plugin>`;
template = template.replace(replaceRegEx, render);

// Replace the field id tag.
Expand Down
6 changes: 3 additions & 3 deletions src/addons/mod/data/services/data-helper.ts
Original file line number Diff line number Diff line change
Expand Up @@ -223,9 +223,9 @@ export class AddonModDataHelperProvider {
let replaceRegex = new RegExp(replace, 'gi');

// Replace field by a generic directive.
const render = '<addon-mod-data-field-plugin [field]="fields[' + field.id + ']" [value]="entries[' + entry.id +
'].contents[' + field.id + ']" mode="' + mode + '" [database]="database" (gotoEntry)="gotoEntry($event)">' +
'</addon-mod-data-field-plugin>';
const render = `<addon-mod-data-field-plugin [field]="fields[${field.id}]" mode="${mode}" [database]="database" \
[value]="entries[${entry.id}].contents[${field.id}]" [recordHasOffline]="${entry.hasOffline ? 'true' : 'false'}" \
(gotoEntry)="gotoEntry($event)"></addon-mod-data-field-plugin>`;

template = template.replace(replaceRegex, render);

Expand Down
4 changes: 2 additions & 2 deletions src/addons/mod/forum/components/index/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -94,8 +94,8 @@
<ion-icon name="fas-star" class="addon-forum-star" *ngIf="discussion.starred"
[attr.aria-label]="'addon.mod_forum.favourites' | translate" />
<span (ariaButtonClick)="discussions?.select(discussion)">
<core-format-text [text]="discussion.subject" contextLevel="module"
[contextInstanceId]="module && module.id" [courseId]="courseId" />
<core-format-text [text]="discussion.subject" [courseId]="courseId" contextLevel="module"
[contextInstanceId]="module && module.id" [sanitize]="isOfflineDiscussion(discussion)" />
</span>
<ion-icon name="fas-lock" *ngIf="discussion.locked" class="addon-mod-forum-locked-icon"
[attr.aria-label]="'addon.mod_forum.discussionlocked' | translate" />
Expand Down
4 changes: 2 additions & 2 deletions src/addons/mod/forum/components/post/post.html
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ <h2 class="ion-text-wrap">
<ion-icon name="fas-star" class="addon-forum-star" [attr.aria-label]="'addon.mod_forum.favourites' | translate"
*ngIf="discussion && !post.parentid && !discussion.pinned && discussion.starred" />
<core-format-text [text]="post.subject" contextLevel="module" [contextInstanceId]="forum && forum.cmid"
[courseId]="courseId" />
[courseId]="courseId" [sanitize]="!post.id || post.id < 0" />
</h2>
<ion-note *ngIf="trackPosts && post.unread" class="ion-float-end ion-padding-start ion-text-end"
[attr.aria-label]="'addon.mod_forum.unread' | translate">
Expand Down Expand Up @@ -59,7 +59,7 @@ <h2 class="ion-text-wrap">
<ion-note color="danger">{{ 'addon.mod_forum.postisprivatereply' | translate }}</ion-note>
</div>
<core-format-text [component]="component" [componentId]="componentId" [text]="post.message" contextLevel="module"
[contextInstanceId]="forum && forum.cmid" [courseId]="courseId" />
[contextInstanceId]="forum && forum.cmid" [courseId]="courseId" [sanitize]="!post.id || post.id < 0" />
<p *ngIf="post.haswordcount && post.wordcount">
<em>{{ 'core.numwords' | translate: {'$a': post.wordcount} }}</em>
</p>
Expand Down
3 changes: 2 additions & 1 deletion src/addons/mod/forum/pages/discussion/discussion.html
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@
</ion-buttons>
<ion-title>
<h1 *ngIf="startingPost">
<core-format-text contextLevel="module" [text]="startingPost.subject" [contextInstanceId]="cmId" [courseId]="courseId" />
<core-format-text contextLevel="module" [text]="startingPost.subject" [contextInstanceId]="cmId" [courseId]="courseId"
[sanitize]="!startingPost.id || startingPost.id < 0" />
</h1>
</ion-title>
<ion-buttons slot="end" />
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ <h2 class="big">{{ 'addon.mod_glossary.entriestobesynced' | translate }}</h2>
<div class="addon-mod-glossary-index--offline-entry">
<ion-icon name="fas-clock" class="ion-margin-end" [attr.aria-label]="'core.notsent' | translate" />
<core-format-text [text]="entry.concept" contextLevel="module" [contextInstanceId]="glossary!.coursemodule"
[courseId]="courseId" />
[courseId]="courseId" [sanitize]="true" />
</div>
</ion-label>
</ion-item>
Expand Down
10 changes: 6 additions & 4 deletions src/addons/mod/glossary/pages/entry/entry.html
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@
</ion-buttons>
<ion-title>
<h1 *ngIf="entry">
<core-format-text [text]="entry.concept" contextLevel="module" [contextInstanceId]="componentId" [courseId]="courseId" />
<core-format-text [text]="entry.concept" contextLevel="module" [contextInstanceId]="componentId" [courseId]="courseId"
[sanitize]="!onlineEntry" />
</h1>
</ion-title>
<ion-buttons slot="end" />
Expand All @@ -30,7 +31,7 @@ <h1 *ngIf="entry">
<ion-label>
<h2>
<core-format-text [text]="entry.concept" contextLevel="module" [contextInstanceId]="componentId"
[courseId]="courseId" />
[courseId]="courseId" [sanitize]="!onlineEntry" />
</h2>
<p *ngIf="onlineEntry">{{ onlineEntry.userfullname }}</p>
</ion-label>
Expand All @@ -39,15 +40,16 @@ <h2>
<ion-item class="ion-text-wrap" *ngIf="!showAuthor">
<ion-label>
<p class="item-heading">
<core-format-text [text]="entry.concept" contextLevel="module" [contextInstanceId]="componentId" />
<core-format-text [text]="entry.concept" contextLevel="module" [contextInstanceId]="componentId"
[sanitize]="!onlineEntry" />
</p>
</ion-label>
<ion-note slot="end" *ngIf="showDate && onlineEntry">{{ onlineEntry.timemodified | coreDateDayOrTime }}</ion-note>
</ion-item>
<ion-item class="ion-text-wrap">
<ion-label>
<core-format-text [component]="component" [componentId]="componentId" [text]="entry.definition"
contextLevel="module" [contextInstanceId]="componentId" [courseId]="courseId" />
contextLevel="module" [contextInstanceId]="componentId" [courseId]="courseId" [sanitize]="!onlineEntry" />
</ion-label>
</ion-item>
<div *ngIf="onlineEntry && onlineEntry.attachment">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -58,11 +58,14 @@
</ion-item>
</ion-card>
</div>
<div class="ion-padding-horizontal addon-mod_wiki-page-content">
<h2 *ngIf="pageTitle">{{pageTitle}}</h2>
<div class="ion-padding-horizontal addon-mod_wiki-page-content" *ngIf="!showLoading">
<h2 *ngIf="pageTitle">
<core-format-text [component]="component" [componentId]="componentId" [text]="pageTitle"
contextLevel="module" [contextInstanceId]="module.id" [courseId]="courseId" [sanitize]="pageIsOffline" />
</h2>
<article [ngClass]="{'addon-mod_wiki-noedit': !canEdit}">
<core-format-text *ngIf="pageContent" [component]="component" [componentId]="componentId" [text]="pageContent"
contextLevel="module" [contextInstanceId]="module.id" [courseId]="courseId" />
contextLevel="module" [contextInstanceId]="module.id" [courseId]="courseId" [sanitize]="pageIsOffline" />
<core-empty-box *ngIf="!pageContent" icon="fas-file-lines" [message]="'addon.mod_wiki.nocontent' | translate" />
</article>

Expand Down
Loading