mirror of
https://github.com/jellyfin/jellyfin-web
synced 2025-03-30 19:56:21 +00:00
Escape HTML
This commit is contained in:
Dmitry Lyzo
parent
08cbc5aa8f
commit
59adbc348a
60 changed files with 245 additions and 192 deletions
|
|
@ -1,4 +1,5 @@
|
|||
import { intervalToDuration } from 'date-fns';
|
||||
import escapeHtml from 'escape-html';
|
||||
import { appHost } from '../../components/apphost';
|
||||
import loading from '../../components/loading/loading';
|
||||
import { appRouter } from '../../components/appRouter';
|
||||
|
|
@ -211,7 +212,7 @@ function renderTrackSelections(page, instance, item, forceReload) {
|
|||
const selectedId = mediaSources[0].Id;
|
||||
select.innerHTML = mediaSources.map(function (v) {
|
||||
const selected = v.Id === selectedId ? ' selected' : '';
|
||||
return '<option value="' + v.Id + '"' + selected + '>' + v.Name + '</option>';
|
||||
return '<option value="' + v.Id + '"' + selected + '>' + escapeHtml(v.Name) + '</option>';
|
||||
}).join('');
|
||||
|
||||
if (mediaSources.length > 1) {
|
||||
|
|
@ -415,7 +416,7 @@ function getArtistLinksHtml(artists, serverId, context) {
|
|||
itemType: 'MusicArtist',
|
||||
serverId: serverId
|
||||
});
|
||||
html.push('<a style="color:inherit;" class="button-link" is="emby-linkbutton" href="' + href + '">' + artist.Name + '</a>');
|
||||
html.push('<a style="color:inherit;" class="button-link" is="emby-linkbutton" href="' + href + '">' + escapeHtml(artist.Name) + '</a>');
|
||||
}
|
||||
|
||||
return html.join(' / ');
|
||||
|
|
@ -438,21 +439,21 @@ function renderName(item, container, context) {
|
|||
parentNameHtml.push(getArtistLinksHtml(item.ArtistItems, item.ServerId, context));
|
||||
parentNameLast = true;
|
||||
} else if (item.SeriesName && item.Type === 'Episode') {
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.SeriesId}" data-serverid="${item.ServerId}" data-type="Series" data-isfolder="true">${item.SeriesName}</a>`);
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.SeriesId}" data-serverid="${item.ServerId}" data-type="Series" data-isfolder="true">${escapeHtml(item.SeriesName)}</a>`);
|
||||
} else if (item.IsSeries || item.EpisodeTitle) {
|
||||
parentNameHtml.push(item.Name);
|
||||
parentNameHtml.push(escapeHtml(item.Name));
|
||||
}
|
||||
|
||||
if (item.SeriesName && item.Type === 'Season') {
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.SeriesId}" data-serverid="${item.ServerId}" data-type="Series" data-isfolder="true">${item.SeriesName}</a>`);
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.SeriesId}" data-serverid="${item.ServerId}" data-type="Series" data-isfolder="true">${escapeHtml(item.SeriesName)}</a>`);
|
||||
} else if (item.ParentIndexNumber != null && item.Type === 'Episode') {
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.SeasonId}" data-serverid="${item.ServerId}" data-type="Season" data-isfolder="true">${item.SeasonName}</a>`);
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.SeasonId}" data-serverid="${item.ServerId}" data-type="Season" data-isfolder="true">${escapeHtml(item.SeasonName)}</a>`);
|
||||
} else if (item.ParentIndexNumber != null && item.IsSeries) {
|
||||
parentNameHtml.push(item.SeasonName || 'S' + item.ParentIndexNumber);
|
||||
parentNameHtml.push(escapeHtml(item.SeasonName) || 'S' + item.ParentIndexNumber);
|
||||
} else if (item.Album && item.AlbumId && (item.Type === 'MusicVideo' || item.Type === 'Audio')) {
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.AlbumId}" data-serverid="${item.ServerId}" data-type="MusicAlbum" data-isfolder="true">${item.Album}</a>`);
|
||||
parentNameHtml.push(`<a style="color:inherit;" class="button-link itemAction" is="emby-linkbutton" href="#" data-action="link" data-id="${item.AlbumId}" data-serverid="${item.ServerId}" data-type="MusicAlbum" data-isfolder="true">${escapeHtml(item.Album)}</a>`);
|
||||
} else if (item.Album) {
|
||||
parentNameHtml.push(item.Album);
|
||||
parentNameHtml.push(escapeHtml(item.Album));
|
||||
}
|
||||
|
||||
// FIXME: This whole section needs some refactoring, so it becames easier to scale across all form factors. See GH #1022
|
||||
|
|
@ -473,9 +474,9 @@ function renderName(item, container, context) {
|
|||
}
|
||||
}
|
||||
|
||||
const name = itemHelper.getDisplayName(item, {
|
||||
const name = escapeHtml(itemHelper.getDisplayName(item, {
|
||||
includeParentInfo: false
|
||||
});
|
||||
}));
|
||||
|
||||
if (html && !parentNameLast) {
|
||||
if (tvSeasonHtml) {
|
||||
|
|
@ -490,7 +491,7 @@ function renderName(item, container, context) {
|
|||
}
|
||||
|
||||
if (item.OriginalTitle && item.OriginalTitle != item.Name) {
|
||||
html += '<h4 class="itemName infoText originalTitle">' + item.OriginalTitle + '</h4>';
|
||||
html += '<h4 class="itemName infoText originalTitle">' + escapeHtml(item.OriginalTitle) + '</h4>';
|
||||
}
|
||||
|
||||
container.innerHTML = html;
|
||||
|
|
@ -667,7 +668,7 @@ function reloadFromItem(instance, page, params, item, user) {
|
|||
location = `<a is="emby-linkbutton" class="button-link textlink" target="_blank" href="https://www.openstreetmap.org/search?query=${encodeURIComponent(location)}">${location}</a>`;
|
||||
}
|
||||
itemBirthLocation.classList.remove('hide');
|
||||
itemBirthLocation.innerHTML = globalize.translate('BirthPlaceValue', location);
|
||||
itemBirthLocation.innerText = globalize.translate('BirthPlaceValue', location);
|
||||
} else {
|
||||
itemBirthLocation.classList.add('hide');
|
||||
}
|
||||
|
|
@ -947,7 +948,7 @@ function renderGenres(page, item, context = inferContext(item)) {
|
|||
Id: p.Id
|
||||
}, {
|
||||
context: context
|
||||
}) + '">' + p.Name + '</a>';
|
||||
}) + '">' + escapeHtml(p.Name) + '</a>';
|
||||
}).join(', ');
|
||||
|
||||
const genresLabel = page.querySelector('.genresLabel');
|
||||
|
|
@ -976,7 +977,7 @@ function renderWriter(page, item, context) {
|
|||
Id: person.Id
|
||||
}, {
|
||||
context: context
|
||||
}) + '">' + person.Name + '</a>';
|
||||
}) + '">' + escapeHtml(person.Name) + '</a>';
|
||||
}).join(', ');
|
||||
|
||||
const writersLabel = page.querySelector('.writersLabel');
|
||||
|
|
@ -1005,7 +1006,7 @@ function renderDirector(page, item, context) {
|
|||
Id: person.Id
|
||||
}, {
|
||||
context: context
|
||||
}) + '">' + person.Name + '</a>';
|
||||
}) + '">' + escapeHtml(person.Name) + '</a>';
|
||||
}).join(', ');
|
||||
|
||||
const directorsLabel = page.querySelector('.directorsLabel');
|
||||
|
|
@ -1058,7 +1059,7 @@ function renderTagline(page, item) {
|
|||
|
||||
if (item.Taglines && item.Taglines.length) {
|
||||
taglineElement.classList.remove('hide');
|
||||
taglineElement.innerHTML = item.Taglines[0];
|
||||
taglineElement.innerText = item.Taglines[0];
|
||||
} else {
|
||||
taglineElement.classList.add('hide');
|
||||
}
|
||||
|
|
@ -1125,7 +1126,7 @@ function renderMoreFromSeason(view, item, apiClient) {
|
|||
}
|
||||
|
||||
section.classList.remove('hide');
|
||||
section.querySelector('h2').innerHTML = globalize.translate('MoreFromValue', item.SeasonName);
|
||||
section.querySelector('h2').innerText = globalize.translate('MoreFromValue', item.SeasonName);
|
||||
const itemsContainer = section.querySelector('.itemsContainer');
|
||||
cardBuilder.buildCards(result.Items, {
|
||||
parentContainer: section,
|
||||
|
|
@ -1184,9 +1185,9 @@ function renderMoreFromArtist(view, item, apiClient) {
|
|||
section.classList.remove('hide');
|
||||
|
||||
if (item.Type === 'MusicArtist') {
|
||||
section.querySelector('h2').innerHTML = globalize.translate('HeaderAppearsOn');
|
||||
section.querySelector('h2').innerText = globalize.translate('HeaderAppearsOn');
|
||||
} else {
|
||||
section.querySelector('h2').innerHTML = globalize.translate('MoreFromValue', item.AlbumArtists[0].Name);
|
||||
section.querySelector('h2').innerText = globalize.translate('MoreFromValue', item.AlbumArtists[0].Name);
|
||||
}
|
||||
|
||||
cardBuilder.buildCards(result.Items, {
|
||||
|
|
@ -1276,7 +1277,7 @@ function renderSeriesAirTime(page, item, isStatic) {
|
|||
}
|
||||
if (item.Studios.length) {
|
||||
if (isStatic) {
|
||||
html += ' on ' + item.Studios[0].Name;
|
||||
html += ' on ' + escapeHtml(item.Studios[0].Name);
|
||||
} else {
|
||||
const context = inferContext(item);
|
||||
const href = appRouter.getRouteUrl(item.Studios[0], {
|
||||
|
|
@ -1284,7 +1285,7 @@ function renderSeriesAirTime(page, item, isStatic) {
|
|||
itemType: 'Studio',
|
||||
serverId: item.ServerId
|
||||
});
|
||||
html += ' on <a class="textlink button-link" is="emby-linkbutton" href="' + href + '">' + item.Studios[0].Name + '</a>';
|
||||
html += ' on <a class="textlink button-link" is="emby-linkbutton" href="' + href + '">' + escapeHtml(item.Studios[0].Name) + '</a>';
|
||||
}
|
||||
}
|
||||
if (html) {
|
||||
|
|
@ -1310,7 +1311,7 @@ function renderTags(page, item) {
|
|||
}
|
||||
|
||||
if (tagElements.length) {
|
||||
itemTags.innerHTML = globalize.translate('TagsValue', tagElements.join(', '));
|
||||
itemTags.innerText = globalize.translate('TagsValue', tagElements.join(', '));
|
||||
itemTags.classList.remove('hide');
|
||||
} else {
|
||||
itemTags.innerHTML = '';
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue