mirror of
https://github.com/discourse/discourse.git
synced 2025-02-25 18:55:32 -06:00
FIX: Apply censored words to inline onebox (#16873)
Censored watched words were not censored inside the title of an inline
oneboxes. Malicious users could exploit this behaviour to insert bad
words. The same issue has been fixed for regular Oneboxes in commit
d184fe59ca.
This commit is contained in:
@@ -108,6 +108,7 @@ class InlineOneboxer
|
||||
end
|
||||
end
|
||||
onebox = { url: url, title: title && Emoji.gsub_emoji_to_unicode(title) }
|
||||
onebox[:title] = WordWatcher.censor_text(onebox[:title])
|
||||
Discourse.cache.write(cache_key(url), onebox, expires_in: 1.day) if !opts[:skip_cache]
|
||||
onebox
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user