Rendered post should be considered safe

boards/templates/boards/all_threads.html

@@ -1,210 +1,210 b''
 {% extends "boards/paginated.html" %}
 
 {% load i18n %}
 {% load board %}
 {% load static %}
 {% load tz %}
 
 {% block head %}
     <meta name="robots" content="noindex">
 
     {% if tag %}
         <title>{{ tag.get_name }} - {{ site_name }}</title>
     {% else %}
         <title>{{ site_name }}</title>
     {% endif %}
 
     {% if prev_page_link %}
-        <link rel="prev" href="{{ prev_page_link }}" />
+        <link rel="prev" href="{{ prev_page_link|safe }}" />
     {% endif %}
     {% if next_page_link %}
-        <link rel="next" href="{{ next_page_link }}" />
+        <link rel="next" href="{{ next_page_link|safe }}" />
     {% endif %}
 
 {% endblock %}
 
 {% block content %}
 
     {% get_current_language as LANGUAGE_CODE %}
     {% get_current_timezone as TIME_ZONE %}
 
     {% for banner in banners %}
         <div class="post">
             <div class="title">{{ banner.title }}</div>
             <div>{{ banner.get_text|safe }}</div>
-            <div>{% trans 'Details' %}: <a href="{{ banner.post.get_absolute_url }}">>>{{ banner.post.id }}</a></div>
+            <div>{% trans 'Details' %}: <a href="{{ banner.post.get_absolute_url|safe }}">>>{{ banner.post.id }}</a></div>
         </div>
     {% endfor %}
 
 {% if tag %}
     <div class="tag_info" style="border-bottom: solid .5ex #{{ tag.get_color }}">
         {% if random_image_post %}
             <div class="tag-image">
                 {% with image=random_image_post.get_first_image %}
-                    <a href="{{ random_image_post.get_absolute_url }}"><img 
-                        src="{{ image.get_thumb_url }}"
+                    <a href="{{ random_image_post.get_absolute_url|safe }}"><img
+                        src="{{ image.get_thumb_url|safe }}"
                         width="{{ image.get_preview_size.0 }}"
                         height="{{ image.get_preview_size.1 }}"
                         alt="{{ random_image_post.id }}"/></a>
                 {% endwith %}
             </div>
         {% endif %}
         <div class="tag-text-data">
             <h2>
                 /{{ tag.get_view|safe }}/
             </h2>
             {% if perms.change_tag %}
                 <div class="moderator_info"><a href="{% url 'admin:boards_tag_change' tag.id %}">{% trans 'Edit tag' %}</a></div>
             {% endif %}
             <p>
                 <form action="{% url 'tag' tag.get_name %}" method="post" class="post-button-form">
                     {% if is_favorite %}
                         <button name="method" value="unsubscribe" class="fav">★ {% trans "Remove from favorites" %}</button>
                     {% else %}
                         <button name="method" value="subscribe" class="not_fav">★ {% trans "Add to favorites" %}</button>
                     {% endif %}
                 </form>
                 &bull;
                 <form action="{% url 'tag' tag.get_name %}" method="post" class="post-button-form">
                     {% if is_hidden %}
                         <button name="method" value="unhide" class="fav">{% trans "Show" %}</button>
                     {% else %}
                         <button name="method" value="hide" class="not_fav">{% trans "Hide" %}</button>
                     {% endif %}
                 </form>
                 &bull;
                 <a href="{% url 'tag_gallery' tag.get_name %}">{% trans 'Gallery' %}</a>
             </p>
             {% if tag.get_description %}
                 <p>{{ tag.get_description|safe }}</p>
             {% endif %}
             <p>
                 {% with active_count=tag.get_active_thread_count bumplimit_count=tag.get_bumplimit_thread_count archived_count=tag.get_archived_thread_count %}
                     {% if active_count %}
                         ● {{ active_count }}&ensp;
                     {% endif %}
                     {% if bumplimit_count %}
                         ◍ {{ bumplimit_count }}&ensp;
                     {% endif %}
                     {% if archived_count %}
                         ○ {{ archived_count }}&ensp;
                     {% endif %}
                 {% endwith %}
                 ♥ {{ tag.get_post_count }}
             </p>
             {% if tag.get_all_parents %}
                 <p>
                     {% for parent in tag.get_all_parents %}
                         {{ parent.get_view|safe }} &gt;
                     {% endfor %}
                     {{ tag.get_view|safe }}
                 </p>
             {% endif %}
             {% if tag.get_children.all %}
                 <p>
                 {% trans "Subsections: " %}
                 {% for child in tag.get_children.all %}
                     {{ child.get_view|safe }}{% if not forloop.last%}, {% endif %}
                 {% endfor %}
                 </p>
             {% endif %}
         </div>
     </div>
 {% endif %}
 
     {% if threads %}
         {% if prev_page_link %}
             <div class="page_link">
                 <a href="{{ prev_page_link }}">&lt;&lt; {% trans "Previous page" %} &lt;&lt;</a>
             </div>
         {% endif %}
 
         {% for thread in threads %}
             <div class="thread">
                 {% post_view thread.get_opening_post thread=thread truncated=True need_open_link=True %}
                 {% if not thread.archived %}
                     {% with last_replies=thread.get_last_replies %}
                         {% if last_replies %}
                             {% with skipped_replies_count=thread.get_skipped_replies_count %}
                                 {% if skipped_replies_count %}
                                     <div class="skipped_replies">
                                         <a href="{% url 'thread' thread.get_opening_post_id %}">
                                             {% blocktrans count count=skipped_replies_count %}Skipped {{ count }} reply. Open thread to see all replies.{% plural %}Skipped {{ count }} replies. Open thread to see all replies.{% endblocktrans %}
                                         </a>
                                     </div>
                                 {% endif %}
                             {% endwith %}
                             <div class="last-replies">
                                 {% for post in last_replies %}
                                     {% post_view post truncated=True %}
                                 {% endfor %}
                             </div>
                         {% endif %}
                     {% endwith %}
                 {% endif %}
             </div>
         {% endfor %}
 
         {% if next_page_link %}
             <div class="page_link">
                 <a href="{{ next_page_link }}">&gt;&gt; {% trans "Next page" %} &gt;&gt;</a>
             </div>
         {% endif %}
     {% else %}
         <div class="post">
             {% trans 'No threads exist. Create the first one!' %}</div>
     {% endif %}
 
     <div class="post-form-w">
         <script src="{% static 'js/panel.js' %}"></script>
         <div class="post-form" data-hasher="{% static 'js/3party/sha256.js' %}"
                                data-pow-script="{% static 'js/proof_of_work.js' %}">
             <div class="form-title">{% trans "Create new thread" %}</div>
             <div class="swappable-form-full">
             <form enctype="multipart/form-data" method="post" id="form">{% csrf_token %}
                 {{ form.as_div }}
                 <div class="form-submit">
                     <input type="submit" value="{% trans "Post" %}"/>
                     <button id="preview-button" type="button" onclick="return false;">{% trans 'Preview' %}</button>
                 </div>
             </form>
             </div>
             <div>
                 {% trans 'Tags must be delimited by spaces. Text or image is required.' %}
                 {% with size=max_file_size|filesizeformat %}
                     {% blocktrans %}Max file size is {{ size }}.{% endblocktrans %}
                 {% endwith %}
                 {% blocktrans %}Max file number is {{ max_files }}.{% endblocktrans %}
             </div>
             <div id="preview-text"></div>
             <div><a href="{% url "staticpage" name="help" %}">{% trans 'Help' %}</a></div>
         </div>
     </div>
 
     <script src="{% static 'js/form.js' %}"></script>
         <script src="{% static 'js/3party/jquery.blockUI.js' %}"></script>
     <script src="{% static 'js/thread_create.js' %}"></script>
 
 {% endblock %}
 
 {% block metapanel %}
 
     <span class="metapanel">
         {% trans "Pages:" %}
         [
         {% with dividers=paginator.get_dividers %}
             {% for page in paginator.get_divided_range %}
                 {% if page in dividers %}
                     …,
                 {% endif %}
                 <a
                     {% ifequal page current_page.number %}
                         class="current_page"
                     {% endifequal %}
                     href="{% page_url paginator page %}">{{ page }}</a>{% if not forloop.last %},{% endif %}
             {% endfor %}
         {% endwith %}
         ]
     </span>
 
 {% endblock %}

boards/templates/boards/post.html

@@ -1,164 +1,166 b''
 {% load i18n %}
 {% load board %}
 
 {% get_current_language as LANGUAGE_CODE %}
 
+{% autoescape off %}
 <div class="{{ css_class }}" id="{{ post.id }}" data-uid="{{ post.uid }}" {% if tree_depth %}style="margin-left: {{ tree_depth }}em;"{% endif %}>
     <div class="post-info">
         <a class="post_id" href="{{ post.get_absolute_url }}">#{{ post.id }}</a>
         {% if is_opening and thread.is_stickerpack %}
             &#128247;
         {% endif %}
         <span class="title">{{ post.title }}</span>
         {% if perms.boards.change_post and post.has_ip %}
             <span class="pub_time" style="border-bottom: solid 2px #{{ post.get_ip_color }};" title="{{ post.poster_ip }}">
         {% else %}
             <span class="pub_time">
         {% endif %}
         <time datetime="{{ post.pub_time|date:'c' }}">{{ post.pub_time }}</time></span>
         {% if post.tripcode %}
             /
             {% with tripcode=post.get_tripcode %}
                 <a href="{% url 'feed' %}?tripcode={{ tripcode.get_full_text }}"
                    class="tripcode" title="{{ tripcode.get_full_text }}"
                    style="border: solid 2px #{{ tripcode.get_color }}; border-left: solid 1ex #{{ tripcode.get_color }};">{{ tripcode.get_short_text }}</a>
             {% endwith %}
         {% endif %}
         {% comment %}
             Thread death time needs to be shown only if the thread is alredy archived
             and this is an opening post (thread death time) or a post for popup
             (we don't see OP here so we show the death time in the post itself).
         {% endcomment %}
         {% if is_opening and thread.is_archived %}
             — <time datetime="{{ thread.bump_time|date:'c' }}">{{ thread.bump_time }}</time>
         {% endif %}
         {% if is_opening %}
             {% if need_open_link %}
                 {% if thread.is_archived %}
                     <a class="link" href="{% url 'thread' post.id %}">{% trans "Open" %}</a>
                 {% else %}
                     <a class="link" href="{% url 'thread' post.id %}#form">{% trans "Reply" %}</a>
                 {% endif %}
             {% endif %}
         {% else %}
             {% if need_op_data %}
                 {% with thread.get_opening_post as op %}
                     {% trans " in " %}{{ op.get_link_view|safe }} <span class="title">{{ op.get_title_or_text }}</span>
                 {% endwith %}
             {% endif %}
         {% endif %}
         {% if reply_link and not thread.is_archived %}
             <a href="#form" onclick="addQuickReply('{{ post.id }}'); return false;">{% trans 'Reply' %}</a>
         {% endif %}
 
         {% if perms.boards.change_post or perms.boards.delete_post or perms.boards.change_thread or perms_boards.delete_thread %}
         <a class="moderation-menu" href="#">🔒</a>
             <script>
                 $.contextMenu({
                     selector: '#{{ post.id }} .moderation-menu',
                     trigger: 'left',
                     build: function($trigger, e) {
                         return {
                             items: {
                                 edit: {
                                     name: '{% trans "Edit" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_post_change' post.id %}';
                                     },
                                     visible: {% if perms.boards.change_post %}true{% else %}false{% endif %}
                                 },
                                 deletePost: {
                                     name: '{% trans "Delete post" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_post_delete' post.id %}';
                                     },
                                     visible: {% if not is_opening and perms.boards.delete_post %}true{% else %}false{% endif %}
                                 },
                                 editThread: {
                                     name: '{% trans "Edit thread" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_thread_change' thread.id %}';
                                     },
                                     visible: {% if is_opening and perms.boards.change_thread %}true{% else %}false{% endif %}
                                 },
                                 deleteThread: {
                                     name: '{% trans "Delete thread" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_thread_delete' thread.id %}';
                                     },
                                     visible: {% if is_opening and perms.boards.delete_thread %}true{% else %}false{% endif %}
                                 },
                                 findByIp: {
                                     name: 'IP = {{ post.poster_ip }}',
                                     callback: function(key, opt) {
                                         window.location = '{% url "feed" %}?ip={{ post.poster_ip }}';
                                     },
                                     visible: {% if post.has_ip %}true{% else %}false{% endif %}
                                 },
                                 raw: {
                                     name: 'RAW',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'post_sync_data' post.id %}';
                                     },
                                     visible: {% if post.global_id_id %}true{% else %}false{% endif %}
                                 },
                                 ban: {
                                     name: '{% trans "Ban" %}',
                                     callback: function(key, opt) {
                                         if (confirm('{% trans "Are you sure?" %}')) {
                                             window.location = '{% url 'utils' %}?method=ban&post_id={{ post.id }}';
                                         }
                                     },
                                     visible: {% if post.has_ip %}true{% else %}false{% endif %}
                                 },
                                 banAndDelete: {
                                     name: '{% trans "Ban and delete" %}',
                                     callback: function(key, opt) {
                                         if (confirm('{% trans "Are you sure?" %}')) {
                                             window.location = '{% url 'utils' %}?method=ban_and_delete&post_id={{ post.id }}';
                                         }
                                     },
                                     visible: {% if post.has_ip %}true{% else %}false{% endif %}
                                 }
                             }
                         };
                     }
                 });
             </script>
         {% endif %}
     </div>
     {% for file in post.attachments.all %}
         {{ file.get_view|safe }}
     {% endfor %}
     {% comment %}
         Post message (text)
     {% endcomment %}
     <div class="message">
         {% if truncated %}
             {{ post.get_text|truncatewords_html:50|truncatenewlines_html:3|safe }}
         {% else %}
             {{ post.get_text|safe }}
         {% endif %}
     </div>
     {% if post.is_referenced and not mode_tree %}
         <div class="refmap">
             {% trans "Replies" %}: {{ post.refmap|safe }}
         </div>
     {% endif %}
     {% comment %}
         Thread metadata: counters, tags etc
     {% endcomment %}
     {% if is_opening %}
         <div class="metadata">
             {% if need_open_link %}
                 ♥ {{ thread.get_reply_count }}
                 ❄ {{ thread.get_images_count }}
                 <a href="{% url 'thread_gallery' post.id %}">G</a>
                 <a href="{% url 'thread_tree' post.id %}">T</a>
             {% endif %}
             <span class="tags">
                 {{ thread.get_tag_url_list|safe }}
             </span>
         </div>
     {% endif %}
 </div>
+{% endautoescape %}
  No newline at end of file