From 6102c287f776682c63be1ffb6554622267fe2522 Mon Sep 17 00:00:00 2001 From: Joffrey JAFFEUX Date: Thu, 12 Mar 2020 16:50:20 +0100 Subject: [PATCH] FIX: prevents i18n helper to return a SafeString (#9191) For convenience the i18n helper has been made returning a SafeString, but when used with other helpers, a String is expected and will cause unexpected behaviors. This is the root cause of the initial bug fixed in https://github.com/discourse/discourse/commit/d2bb127e2c8c4a4df30024883ee36472fc86b688 This commit is kept as it's a better security in case of unexpected behavior. --- .../components/admin-report-storage-stats.hbs | 2 +- .../templates/components/penalty-post-action.hbs | 2 +- .../admin/templates/components/silence-details.hbs | 2 +- .../templates/components/suspension-details.hbs | 4 ++-- .../admin/templates/dashboard_general.hbs | 2 +- app/assets/javascripts/admin/templates/embedding.hbs | 2 +- .../admin/templates/modal/admin-badge-preview.hbs | 4 ++-- .../javascripts/admin/templates/user-index.hbs | 2 +- .../javascripts/discourse-common/helpers/i18n.js.es6 | 3 +-- .../discourse/helpers/replace-emoji.js.es6 | 8 ++++---- .../discourse/templates/account-created/resent.hbs | 2 +- .../templates/components/discourse-banner.hbs | 2 +- .../templates/components/edit-category-general.hbs | 2 +- .../templates/components/edit-category-security.hbs | 2 +- .../discourse/templates/components/ip-lookup.hbs | 2 +- .../templates/components/related-messages.hbs | 2 +- .../templates/components/shared-draft-controls.hbs | 2 +- .../discourse/templates/components/tag-info.hbs | 2 +- .../discourse/templates/components/user-stat.hbs | 2 +- .../discourse/templates/modal/activation-resent.hbs | 2 +- .../discourse/templates/modal/auth-token.hbs | 2 +- .../discourse/templates/modal/avatar-selector.hbs | 4 ++-- .../discourse/templates/modal/bookmark.hbs | 2 +- .../discourse/templates/modal/change-owner.hbs | 8 +++++--- .../templates/modal/delete-topic-disallowed.hbs | 2 +- .../discourse/templates/modal/feature-topic.hbs | 12 ++++++------ .../discourse/templates/modal/move-to-topic.hbs | 10 +++++----- .../discourse/templates/modal/not-activated.hbs | 2 +- .../discourse/templates/modal/post-enqueued.hbs | 2 +- .../modal/second-factor-add-security-key.hbs | 2 +- .../templates/modal/second-factor-add-totp.hbs | 2 +- .../templates/modal/second-factor-backup-edit.hbs | 2 +- .../discourse/templates/modal/topic-bulk-actions.hbs | 2 +- .../templates/preferences-second-factor.hbs | 2 +- .../discourse/templates/preferences/account.hbs | 2 +- .../discourse/templates/preferences/emails.hbs | 2 +- app/assets/javascripts/discourse/templates/topic.hbs | 2 +- .../discourse/templates/user-invited-show.hbs | 2 +- .../components/discourse-local-dates-create-form.hbs | 2 +- 39 files changed, 58 insertions(+), 57 deletions(-) diff --git a/app/assets/javascripts/admin/templates/components/admin-report-storage-stats.hbs b/app/assets/javascripts/admin/templates/components/admin-report-storage-stats.hbs index d6e42cd414c..246d23be258 100644 --- a/app/assets/javascripts/admin/templates/components/admin-report-storage-stats.hbs +++ b/app/assets/javascripts/admin/templates/components/admin-report-storage-stats.hbs @@ -15,7 +15,7 @@ {{#if backupStats.last_backup_taken_at}}
- {{i18n "admin.dashboard.lastest_backup" date=(format-date backupStats.last_backup_taken_at leaveAgo="true")}} + {{html-safe (i18n "admin.dashboard.lastest_backup" date=(format-date backupStats.last_backup_taken_at leaveAgo="true"))}} {{/if}}

diff --git a/app/assets/javascripts/admin/templates/components/penalty-post-action.hbs b/app/assets/javascripts/admin/templates/components/penalty-post-action.hbs index a6c848541ff..b566df7de60 100644 --- a/app/assets/javascripts/admin/templates/components/penalty-post-action.hbs +++ b/app/assets/javascripts/admin/templates/components/penalty-post-action.hbs @@ -1,7 +1,7 @@
{{combo-box diff --git a/app/assets/javascripts/admin/templates/components/silence-details.hbs b/app/assets/javascripts/admin/templates/components/silence-details.hbs index af1b4980d5b..bdcb21cbc58 100644 --- a/app/assets/javascripts/admin/templates/components/silence-details.hbs +++ b/app/assets/javascripts/admin/templates/components/silence-details.hbs @@ -1,7 +1,7 @@
{{text-field diff --git a/app/assets/javascripts/admin/templates/components/suspension-details.hbs b/app/assets/javascripts/admin/templates/components/suspension-details.hbs index 4dcc606b2b9..70968ae746a 100644 --- a/app/assets/javascripts/admin/templates/components/suspension-details.hbs +++ b/app/assets/javascripts/admin/templates/components/suspension-details.hbs @@ -2,9 +2,9 @@ diff --git a/app/assets/javascripts/admin/templates/dashboard_general.hbs b/app/assets/javascripts/admin/templates/dashboard_general.hbs index d190b7664b7..94150fef958 100644 --- a/app/assets/javascripts/admin/templates/dashboard_general.hbs +++ b/app/assets/javascripts/admin/templates/dashboard_general.hbs @@ -142,7 +142,7 @@ filters=trendingSearchFilters isEnabled=logSearchQueriesEnabled disabledLabel=trendingSearchDisabledLabel}} - {{i18n "admin.dashboard.reports.trending_search.more" basePath=basePath}} + {{html-safe (i18n "admin.dashboard.reports.trending_search.more" basePath=basePath)}}
diff --git a/app/assets/javascripts/admin/templates/embedding.hbs b/app/assets/javascripts/admin/templates/embedding.hbs index 17772636745..2a5d39f12cc 100644 --- a/app/assets/javascripts/admin/templates/embedding.hbs +++ b/app/assets/javascripts/admin/templates/embedding.hbs @@ -23,7 +23,7 @@ {{#if showSecondary}}
-

{{i18n "admin.embedding.sample"}}

+

{{html-safe (i18n "admin.embedding.sample")}}

{{highlighted-code code=embeddingCode lang="html"}}
diff --git a/app/assets/javascripts/admin/templates/modal/admin-badge-preview.hbs b/app/assets/javascripts/admin/templates/modal/admin-badge-preview.hbs index eaab7e615f5..219dee18d45 100644 --- a/app/assets/javascripts/admin/templates/modal/admin-badge-preview.hbs +++ b/app/assets/javascripts/admin/templates/modal/admin-badge-preview.hbs @@ -17,9 +17,9 @@ {{else}}

{{#if count}} - {{i18n "admin.badges.preview.grant_count" count=count}} + {{html-safe (i18n "admin.badges.preview.grant_count" count=count)}} {{else}} - {{i18n "admin.badges.preview.no_grant_count"}} + {{html-safe (i18n "admin.badges.preview.no_grant_count")}} {{/if}}

diff --git a/app/assets/javascripts/admin/templates/user-index.hbs b/app/assets/javascripts/admin/templates/user-index.hbs index 23a1a6aae30..f5abf9f8dda 100644 --- a/app/assets/javascripts/admin/templates/user-index.hbs +++ b/app/assets/javascripts/admin/templates/user-index.hbs @@ -132,7 +132,7 @@
{{i18n "user.avatar.title"}}
{{avatar model imageSize="large"}}
- {{i18n "admin.user.visit_profile" url=preferencesPath}} + {{html-safe (i18n "admin.user.visit_profile" url=preferencesPath)}}
diff --git a/app/assets/javascripts/discourse-common/helpers/i18n.js.es6 b/app/assets/javascripts/discourse-common/helpers/i18n.js.es6 index c3d7f1e448c..902ed699bfd 100644 --- a/app/assets/javascripts/discourse-common/helpers/i18n.js.es6 +++ b/app/assets/javascripts/discourse-common/helpers/i18n.js.es6 @@ -1,7 +1,6 @@ import { registerUnbound } from "discourse-common/lib/helpers"; -import { htmlSafe } from "@ember/template"; -registerUnbound("i18n", (key, params) => htmlSafe(I18n.t(key, params))); +registerUnbound("i18n", (key, params) => I18n.t(key, params)); registerUnbound("i18n-yes-no", (value, params) => I18n.t(value ? "yes_value" : "no_value", params) ); diff --git a/app/assets/javascripts/discourse/helpers/replace-emoji.js.es6 b/app/assets/javascripts/discourse/helpers/replace-emoji.js.es6 index 37365a5781e..80a5dd42100 100644 --- a/app/assets/javascripts/discourse/helpers/replace-emoji.js.es6 +++ b/app/assets/javascripts/discourse/helpers/replace-emoji.js.es6 @@ -1,7 +1,7 @@ import { registerUnbound } from "discourse-common/lib/helpers"; import { emojiUnescape } from "discourse/lib/text"; +import { htmlSafe } from "@ember/template"; -registerUnbound( - "replace-emoji", - text => new Handlebars.SafeString(emojiUnescape(text)) -); +registerUnbound("replace-emoji", text => { + return htmlSafe(emojiUnescape(text)); +}); diff --git a/app/assets/javascripts/discourse/templates/account-created/resent.hbs b/app/assets/javascripts/discourse/templates/account-created/resent.hbs index 5ad9168986f..16c29c4b9b9 100644 --- a/app/assets/javascripts/discourse/templates/account-created/resent.hbs +++ b/app/assets/javascripts/discourse/templates/account-created/resent.hbs @@ -1,6 +1,6 @@
{{#if email}} - {{i18n 'login.sent_activation_email_again' currentEmail=email}} + {{html-safe (i18n 'login.sent_activation_email_again' currentEmail=email)}} {{else}} {{i18n 'login.sent_activation_email_again_generic'}} {{/if}} diff --git a/app/assets/javascripts/discourse/templates/components/discourse-banner.hbs b/app/assets/javascripts/discourse/templates/components/discourse-banner.hbs index cda2c2069ac..9b6b18c5300 100644 --- a/app/assets/javascripts/discourse/templates/components/discourse-banner.hbs +++ b/app/assets/javascripts/discourse/templates/components/discourse-banner.hbs @@ -5,7 +5,7 @@
diff --git a/app/assets/javascripts/discourse/templates/components/edit-category-general.hbs b/app/assets/javascripts/discourse/templates/components/edit-category-general.hbs index 7884f85e1f3..9799c5ee42f 100644 --- a/app/assets/javascripts/discourse/templates/components/edit-category-general.hbs +++ b/app/assets/javascripts/discourse/templates/components/edit-category-general.hbs @@ -1,7 +1,7 @@ {{#if category.isUncategorizedCategory}}

{{d-icon "exclamation-triangle"}} - {{i18n 'category.uncategorized_general_warning' settingLink=uncategorizedSiteSettingLink customizeLink=customizeTextContentLink}} + {{html-safe (i18n 'category.uncategorized_general_warning' settingLink=uncategorizedSiteSettingLink customizeLink=customizeTextContentLink)}}

{{/if}} diff --git a/app/assets/javascripts/discourse/templates/components/edit-category-security.hbs b/app/assets/javascripts/discourse/templates/components/edit-category-security.hbs index 5b132092c49..68fb66239c4 100644 --- a/app/assets/javascripts/discourse/templates/components/edit-category-security.hbs +++ b/app/assets/javascripts/discourse/templates/components/edit-category-security.hbs @@ -11,7 +11,7 @@ {{#each category.permissions as |p|}}
  • {{p.group_name}} - {{i18n "category.can"}} + {{html-safe (i18n "category.can")}} {{p.permission.description}} {{#if editingPermissions}} {{d-icon "times-circle"}} diff --git a/app/assets/javascripts/discourse/templates/components/ip-lookup.hbs b/app/assets/javascripts/discourse/templates/components/ip-lookup.hbs index 9b7b7bebc4a..35e074e661c 100644 --- a/app/assets/javascripts/discourse/templates/components/ip-lookup.hbs +++ b/app/assets/javascripts/discourse/templates/components/ip-lookup.hbs @@ -14,7 +14,7 @@ {{d-button action=(action "copy") class="pull-right no-text" icon="copy"}} {{/if}}

    {{i18n "ip_lookup.title"}}

    -

    {{i18n "ip_lookup.powered_by"}}

    +

    {{html-safe (i18n "ip_lookup.powered_by")}}

    {{#if location}} {{#if location.hostname}} diff --git a/app/assets/javascripts/discourse/templates/components/related-messages.hbs b/app/assets/javascripts/discourse/templates/components/related-messages.hbs index 09e1abb1a15..d4443bd2c36 100644 --- a/app/assets/javascripts/discourse/templates/components/related-messages.hbs +++ b/app/assets/javascripts/discourse/templates/components/related-messages.hbs @@ -10,5 +10,5 @@ {{#if targetUser}} -

    {{i18n "related_messages.see_all" path=searchLink username=targetUser.username}}

    +

    {{html-safe (i18n "related_messages.see_all" path=searchLink username=targetUser.username)}}

    {{/if}} diff --git a/app/assets/javascripts/discourse/templates/components/shared-draft-controls.hbs b/app/assets/javascripts/discourse/templates/components/shared-draft-controls.hbs index d42eb1b1779..f641a14a56c 100644 --- a/app/assets/javascripts/discourse/templates/components/shared-draft-controls.hbs +++ b/app/assets/javascripts/discourse/templates/components/shared-draft-controls.hbs @@ -2,7 +2,7 @@ {{#if publishing}} {{i18n "shared_drafts.publishing"}} {{else}} - {{i18n "shared_drafts.notice" category=topic.category.name}} + {{html-safe (i18n "shared_drafts.notice" category=topic.category.name)}}
    diff --git a/app/assets/javascripts/discourse/templates/components/tag-info.hbs b/app/assets/javascripts/discourse/templates/components/tag-info.hbs index aa1f4889d1d..b1031c4558b 100644 --- a/app/assets/javascripts/discourse/templates/components/tag-info.hbs +++ b/app/assets/javascripts/discourse/templates/components/tag-info.hbs @@ -32,7 +32,7 @@ {{#if tagInfo.synonyms}}

    {{i18n "tagging.synonyms"}}

    -
    {{i18n "tagging.synonyms_description" base_tag_name=tagInfo.name}}
    +
    {{html-safe (i18n "tagging.synonyms_description" base_tag_name=tagInfo.name)}}
    {{#each tagInfo.synonyms as |tag|}}
    diff --git a/app/assets/javascripts/discourse/templates/components/user-stat.hbs b/app/assets/javascripts/discourse/templates/components/user-stat.hbs index 69704bf892f..20bbb3204ae 100644 --- a/app/assets/javascripts/discourse/templates/components/user-stat.hbs +++ b/app/assets/javascripts/discourse/templates/components/user-stat.hbs @@ -9,5 +9,5 @@ {{#if icon}}{{d-icon icon}}{{/if}} - {{i18n label count=value}} + {{html-safe (i18n label count=value)}} diff --git a/app/assets/javascripts/discourse/templates/modal/activation-resent.hbs b/app/assets/javascripts/discourse/templates/modal/activation-resent.hbs index 7439589d5ce..8780608607b 100644 --- a/app/assets/javascripts/discourse/templates/modal/activation-resent.hbs +++ b/app/assets/javascripts/discourse/templates/modal/activation-resent.hbs @@ -1,5 +1,5 @@ {{#d-modal-body}} - {{i18n 'login.sent_activation_email_again' currentEmail=currentEmail}} + {{html-safe (i18n 'login.sent_activation_email_again' currentEmail=currentEmail)}} {{/d-modal-body}} {{modal-footer-close closeModal=(route-action "closeModal")}} diff --git a/app/assets/javascripts/discourse/templates/modal/auth-token.hbs b/app/assets/javascripts/discourse/templates/modal/auth-token.hbs index 5390227a2e9..add7e7ce5ad 100644 --- a/app/assets/javascripts/discourse/templates/modal/auth-token.hbs +++ b/app/assets/javascripts/discourse/templates/modal/auth-token.hbs @@ -1,7 +1,7 @@ {{#d-modal-body title="user.auth_tokens.was_this_you"}}

    {{i18n 'user.auth_tokens.was_this_you_description'}}

    -

    {{i18n 'user.second_factor.extended_description'}}

    +

    {{html-safe (i18n 'user.second_factor.extended_description')}}

    diff --git a/app/assets/javascripts/discourse/templates/modal/avatar-selector.hbs b/app/assets/javascripts/discourse/templates/modal/avatar-selector.hbs index 98504b09818..edc2c4a4d89 100644 --- a/app/assets/javascripts/discourse/templates/modal/avatar-selector.hbs +++ b/app/assets/javascripts/discourse/templates/modal/avatar-selector.hbs @@ -10,11 +10,11 @@ {{else}}
    {{radio-button id="system-avatar" name="avatar" value="system" selection=selected}} - +
    {{radio-button id="gravatar" name="avatar" value="gravatar" selection=selected}} - + {{d-button action=(action "refreshGravatar") translatedTitle=(i18n "user.change_avatar.refresh_gravatar_title" gravatarName=gravatarName) diff --git a/app/assets/javascripts/discourse/templates/modal/bookmark.hbs b/app/assets/javascripts/discourse/templates/modal/bookmark.hbs index 782ebe9cabe..661ab90f279 100644 --- a/app/assets/javascripts/discourse/templates/modal/bookmark.hbs +++ b/app/assets/javascripts/discourse/templates/modal/bookmark.hbs @@ -50,7 +50,7 @@ {{/if}} {{else}} -
    {{i18n "bookmarks.no_timezone" basePath=basePath }}
    +
    {{html-safe (i18n "bookmarks.no_timezone" basePath=basePath)}}
    {{/if}}
    {{/if}} diff --git a/app/assets/javascripts/discourse/templates/modal/change-owner.hbs b/app/assets/javascripts/discourse/templates/modal/change-owner.hbs index a4e0a35c9b0..13ee97c97b6 100644 --- a/app/assets/javascripts/discourse/templates/modal/change-owner.hbs +++ b/app/assets/javascripts/discourse/templates/modal/change-owner.hbs @@ -1,8 +1,10 @@ {{#d-modal-body class='change-ownership'}} - {{i18n (if selectedPostsUsername 'topic.change_owner.instructions' 'topic.change_owner.instructions_without_old_user') - count=selectedPostsCount - old_user=selectedPostsUsername}} + {{html-safe (i18n (if selectedPostsUsername 'topic.change_owner.instructions' 'topic.change_owner.instructions_without_old_user') + count=selectedPostsCount + old_user=selectedPostsUsername + ) + }}
    diff --git a/app/assets/javascripts/discourse/templates/modal/delete-topic-disallowed.hbs b/app/assets/javascripts/discourse/templates/modal/delete-topic-disallowed.hbs index 61e693a9af4..b6ab282d380 100644 --- a/app/assets/javascripts/discourse/templates/modal/delete-topic-disallowed.hbs +++ b/app/assets/javascripts/discourse/templates/modal/delete-topic-disallowed.hbs @@ -1,5 +1,5 @@ {{#d-modal-body}} -

    {{i18n "post.controls.delete_topic_disallowed_modal"}}

    +

    {{html-safe (i18n "post.controls.delete_topic_disallowed_modal")}}

    {{/d-modal-body}} {{#if existingTopic}} -

    {{i18n 'topic.merge_topic.instructions' count=selectedPostsCount}}

    +

    {{html-safe (i18n 'topic.merge_topic.instructions' count=selectedPostsCount)}}

    {{choose-topic currentTopicId=model.id selectedTopicId=selectedTopicId}}
    @@ -72,7 +72,7 @@ {{#if canSplitTopic}} {{#if newTopic}} -

    {{i18n 'topic.split_topic.instructions' count=selectedPostsCount}}

    +

    {{html-safe (i18n 'topic.split_topic.instructions' count=selectedPostsCount)}}

    {{text-field value=topicName placeholderKey="composer.title_placeholder" elementId='split-topic-name'}} @@ -93,7 +93,7 @@ {{#if canSplitTopic}} {{#if newMessage}} -

    {{i18n 'topic.move_to_new_message.instructions' count=selectedPostsCount}}

    +

    {{html-safe (i18n 'topic.move_to_new_message.instructions' count=selectedPostsCount)}}

    {{text-field value=topicName placeholderKey="composer.title_placeholder" elementId='split-topic-name'}} diff --git a/app/assets/javascripts/discourse/templates/modal/not-activated.hbs b/app/assets/javascripts/discourse/templates/modal/not-activated.hbs index e9d93aa8f63..b1ba99bdc92 100644 --- a/app/assets/javascripts/discourse/templates/modal/not-activated.hbs +++ b/app/assets/javascripts/discourse/templates/modal/not-activated.hbs @@ -1,5 +1,5 @@ {{#d-modal-body}} - {{i18n 'login.not_activated' sentTo=sentTo}} + {{html-safe (i18n 'login.not_activated' sentTo=sentTo)}} {{/d-modal-body}}