plutopluto

commit

5628335eae1447cd828d11477e705b41161ed7ba

parent

a3be8b2a35f4c17e59104fe98ae11076cd3627df

Author

Tobias Bengfort <tobias.bengfort@posteo.de>

Date

2023-12-21 10:36

properly escape feed content

Diffstat

1 files changed, 4 insertions, 4 deletions

diff --git a/plutopluto/__init__.py b/plutopluto/__init__.py

@@ -39,7 +39,7 @@ async def fetch(url, *, raw=False, **kwargs):
   39    39 
   40    40 def linebreaks(text):
   41    41     html = (
   42    -1         text
   -1    42         escape(text)
   43    43         .replace('\n\n', '</p><p>')
   44    44         .replace('\n', '<br>')
   45    45     )
@@ -68,9 +68,9 @@ async def parse_feed(url):
   68    68         if '<' not in d['content']:
   69    69             d['content'] = linebreaks(d['content'])
   70    70         if 'youtube' in url:
   71    -1             thumbnail = '<a href="%s"><img alt="" src="%s" /></a>' % (
   72    -1                 d['link'],
   73    -1                 item['media_thumbnail'][0]['url'],
   -1    71             thumbnail = '<a href="{}"><img alt="" src="{}" /></a>'.format(
   -1    72                 escape(d['link']),
   -1    73                 escape(item['media_thumbnail'][0]['url']),
   74    74             )
   75    75             d['content'] = thumbnail + d['content']
   76    76         return d