fix #1100

typecho · Jun 8, 2021 · 4861a40 · 4861a40
1 parent 0e49d18
commit 4861a40
Show file tree

Hide file tree

Showing 5 changed files with 1,371 additions and 2 deletions.
diff --git a/admin/css/style.css b/admin/css/style.css
@@ -826,6 +826,8 @@ a.operate-reply { color: #545c30; }
 
 #wmd-preview .summary:after { display: block; margin: 2em 0; background: #FFF9E8; color: #cf9900; font-size: .85714em; text-align: center; content: "- more -"; }
 
+#wmd-preview .embed { border: 1px solid #ccc; height: 40px; overflow: hidden; line-height: 40px; text-align: center; font-size: 12px; color: #777; }
+
 #wmd-preview table { width: 100%; }
 
 #wmd-preview table th, #wmd-preview table td { border: 1px solid #DDD; padding: 5px 8px; word-break: break-all; }

diff --git a/admin/editor-js.php b/admin/editor-js.php
@@ -3,6 +3,7 @@
 <script src="<?php $options->adminStaticUrl('js', 'hyperdown.js?v=' . $suffixVersion); ?>"></script>
 <script src="<?php $options->adminStaticUrl('js', 'pagedown.js?v=' . $suffixVersion); ?>"></script>
 <script src="<?php $options->adminStaticUrl('js', 'paste.js?v=' . $suffixVersion); ?>"></script>
+<script src="<?php $options->adminStaticUrl('js', 'purify.js?v=' . $suffixVersion); ?>"></script>
 <script>
 $(document).ready(function () {
     var textarea = $('#text'),
@@ -85,11 +86,11 @@
                 src = src.substring(0, src.length - 1);
             }
 
-            return '<div style="border: 1px solid #ccc; height: 40px; overflow: hidden; line-height: 40px; text-align: center; font-size: 12px; color: #777"><strong>'
+            return '<div class="embed"><strong>'
                 + tag + '</strong> : ' + $.trim(src) + '</div>';
         });
 
-        return html;
+        return DOMPurify.sanitize(html, {USE_PROFILES: {html: true}});
     });
 
     editor.hooks.chain('onPreviewRefresh', function () {

diff --git a/admin/js/purify.js b/admin/js/purify.js