FIX: Apply censored words to inline onebox (#16873)

Censored watched words were not censored inside the title of an inline
oneboxes. Malicious users could exploit this behaviour to insert bad
words. The same issue has been fixed for regular Oneboxes in commit
d184fe59ca.
This commit is contained in:
Bianca Nenciu
2022-05-25 14:51:47 +03:00
committed by GitHub
parent 6268fe7495
commit 7328a2bfb0
3 changed files with 41 additions and 11 deletions

View File

@@ -108,6 +108,7 @@ class InlineOneboxer
end
end
onebox = { url: url, title: title && Emoji.gsub_emoji_to_unicode(title) }
onebox[:title] = WordWatcher.censor_text(onebox[:title])
Discourse.cache.write(cache_key(url), onebox, expires_in: 1.day) if !opts[:skip_cache]
onebox
end