Fix #4678: Validate custom CSS.

* Make it an error to add invalid custom CSS to your account.
* Add a fix script to remove custom CSS from all accounts with invalid CSS.
This commit is contained in:
evazion
2022-01-15 23:20:15 -06:00
parent c455c08b2c
commit acf565be7b
8 changed files with 70 additions and 2 deletions

View File

@@ -106,6 +106,7 @@ class User < ApplicationRecord
validates :password, confirmation: true
validates :comment_threshold, inclusion: { in: (-100..5) }
validate :validate_enable_private_favorites, on: :update
validate :validate_custom_css, if: :custom_style_changed?
before_validation :normalize_blacklisted_tags
before_create :promote_to_owner_if_first_user
has_many :artist_versions, foreign_key: :updater_id
@@ -601,6 +602,18 @@ class User < ApplicationRecord
end
end
concerning :CustomCssMethods do
def custom_css
CustomCss.new(custom_style)
end
def validate_custom_css
if !custom_css.valid?
errors.add(:base, "Custom CSS contains a syntax error. Validate it with https://codebeautify.org/cssvalidate")
end
end
end
module SearchMethods
def search(params)
params = params.dup