From 457004794ca7b29b677695fcaae9fefd32f05869 Mon Sep 17 00:00:00 2001
From: Bob Mottram <bob@freedombone.net>
Date: Tue, 6 Jul 2021 10:44:45 +0100
Subject: [PATCH] Function for checking url prefixes

---
 utils.py                | 12 +++++++
 webapp_headerbuttons.py | 12 +++----
 webapp_login.py         | 73 ++++++++++++++++++++---------------------
 webapp_media.py         | 66 +++++++++++++++++--------------------
 4 files changed, 81 insertions(+), 82 deletions(-)

diff --git a/utils.py b/utils.py
index 6e291f1ae..0d85039cb 100644
--- a/utils.py
+++ b/utils.py
@@ -2536,3 +2536,15 @@ def getPortFromDomain(domain: str) -> int:
         if portStr.isdigit():
             return int(portStr)
     return None
+
+
+def validUrlPrefix(url: str) -> bool:
+    """Does the given url have a valid prefix?
+    """
+    if '/' not in url:
+        return False
+    prefixes = ('https:', 'http:', 'hyper:', 'i2p:', 'gnunet:')
+    for pre in prefixes:
+        if url.startswith(pre):
+            return True
+    return False
diff --git a/webapp_headerbuttons.py b/webapp_headerbuttons.py
index 99ab01290..a50e01da6 100644
--- a/webapp_headerbuttons.py
+++ b/webapp_headerbuttons.py
@@ -54,8 +54,7 @@ def headerButtonsTimeline(defaultTimeline: str,
     # first button
     if defaultTimeline == 'tlmedia':
         tlStr += \
-            '<a href="' + usersPath + \
-            '/tlmedia" tabindex="-1" ' + \
+            '<a href="' + usersPath + '/tlmedia" tabindex="-1" ' + \
             'accesskey="' + accessKeys['menuMedia'] + '"' + \
             '><button class="' + \
             mediaButton + '"><span>' + translate['Media'] + \
@@ -105,8 +104,7 @@ def headerButtonsTimeline(defaultTimeline: str,
     if defaultTimeline != 'tlmedia':
         if not minimal and not featuresHeader:
             tlStr += \
-                '<a href="' + usersPath + \
-                '/tlmedia" tabindex="-1" ' + \
+                '<a href="' + usersPath + '/tlmedia" tabindex="-1" ' + \
                 'accesskey="' + accessKeys['menuMedia'] + '">' + \
                 '<button class="' + \
                 mediaButton + '"><span>' + translate['Media'] + \
@@ -206,10 +204,8 @@ def headerButtonsTimeline(defaultTimeline: str,
     if not featuresHeader:
         # button for the outbox
         tlStr += \
-            '<a href="' + usersPath + \
-            '/outbox"><button class="' + \
-            sentButton + '" tabindex="-1">' + \
-            '<span>' + translate['Sent'] + \
+            '<a href="' + usersPath + '/outbox"><button class="' + \
+            sentButton + '" tabindex="-1"><span>' + translate['Sent'] + \
             '</span></button></a>'
 
         # add other buttons
diff --git a/webapp_login.py b/webapp_login.py
index 72a0f3846..45de12739 100644
--- a/webapp_login.py
+++ b/webapp_login.py
@@ -36,18 +36,19 @@ def htmlGetLoginCredentials(loginParams: str,
     password = None
     register = False
     for arg in loginArgs:
-        if '=' in arg:
-            if arg.split('=', 1)[0] == 'username':
-                nickname = arg.split('=', 1)[1]
-                if nickname.startswith('@'):
-                    nickname = nickname[1:]
-                if '@' in nickname:
-                    # the full nickname@domain has been entered
-                    nickname = nickname.split('@')[0]
-            elif arg.split('=', 1)[0] == 'password':
-                password = arg.split('=', 1)[1]
-            elif arg.split('=', 1)[0] == 'register':
-                register = True
+        if '=' not in arg:
+            continue
+        if arg.split('=', 1)[0] == 'username':
+            nickname = arg.split('=', 1)[1]
+            if nickname.startswith('@'):
+                nickname = nickname[1:]
+            if '@' in nickname:
+                # the full nickname@domain has been entered
+                nickname = nickname.split('@')[0]
+        elif arg.split('=', 1)[0] == 'password':
+            password = arg.split('=', 1)[1]
+        elif arg.split('=', 1)[0] == 'register':
+            register = True
     return nickname, password, register
 
 
@@ -103,8 +104,7 @@ def htmlLogin(cssCache: {}, translate: {},
     else:
         loginText = \
             '<p class="login-text">' + \
-            translate['Please enter some credentials'] + '</p>'
-        loginText += \
+            translate['Please enter some credentials'] + '</p>' + \
             '<p class="login-text">' + \
             translate['You will become the admin of this site.'] + \
             '</p>'
@@ -132,8 +132,7 @@ def htmlLogin(cssCache: {}, translate: {},
 
     TOSstr = \
         '<p class="login-text"><a href="/about">' + \
-        translate['About this Instance'] + '</a></p>'
-    TOSstr += \
+        translate['About this Instance'] + '</a></p>' + \
         '<p class="login-text"><a href="/terms">' + \
         translate['Terms of Service'] + '</a></p>'
 
@@ -153,34 +152,32 @@ def htmlLogin(cssCache: {}, translate: {},
         htmlHeaderWithWebsiteMarkup(cssFilename, instanceTitle,
                                     httpPrefix, domain,
                                     systemLanguage)
-    loginForm += '<br>\n'
-    loginForm += '<form method="POST" action="/login">\n'
-    loginForm += '  <div class="imgcontainer">\n'
     instanceTitle = getConfigParam(baseDir, 'instanceTitle')
-    loginForm += textModeLogoHtml + '\n'
     loginForm += \
+        '<br>\n' + \
+        '<form method="POST" action="/login">\n' + \
+        '  <div class="imgcontainer">\n' + \
+        textModeLogoHtml + '\n' + \
         '    <img loading="lazy" src="' + loginImage + \
-        '" alt="' + instanceTitle + '" class="loginimage">\n'
-    loginForm += loginText + TOSstr + '\n'
-    loginForm += '  </div>\n'
-    loginForm += '\n'
-    loginForm += '  <div class="container">\n'
-    loginForm += '    <label for="nickname"><b>' + \
-        translate['Nickname'] + '</b></label>\n'
-    loginForm += \
+        '" alt="' + instanceTitle + '" class="loginimage">\n' + \
+        loginText + TOSstr + '\n' + \
+        '  </div>\n' + \
+        '\n' + \
+        '  <div class="container">\n' + \
+        '    <label for="nickname"><b>' + \
+        translate['Nickname'] + '</b></label>\n' + \
         '    <input type="text" ' + autocompleteStr + ' placeholder="' + \
-        translate['Enter Nickname'] + '" name="username" required autofocus>\n'
-    loginForm += '\n'
-    loginForm += '    <label for="password"><b>' + \
-        translate['Password'] + '</b></label>\n'
-    loginForm += \
+        translate['Enter Nickname'] + \
+        '" name="username" required autofocus>\n' + \
+        '\n' + \
+        '    <label for="password"><b>' + \
+        translate['Password'] + '</b></label>\n' + \
         '    <input type="password" ' + autocompleteStr + \
         ' placeholder="' + translate['Enter Password'] + \
-        '" name="password" required>\n'
-    loginForm += loginButtonStr + registerButtonStr + '\n'
-    loginForm += '  </div>\n'
-    loginForm += '</form>\n'
-    loginForm += \
+        '" name="password" required>\n' + \
+        loginButtonStr + registerButtonStr + '\n' + \
+        '  </div>\n' + \
+        '</form>\n' + \
         '<a href="https://gitlab.com/bashrc2/epicyon">' + \
         '<img loading="lazy" class="license" title="' + \
         translate['Get the source code'] + '" alt="' + \
diff --git a/webapp_media.py b/webapp_media.py
index 4d5ff6366..5ef899fe0 100644
--- a/webapp_media.py
+++ b/webapp_media.py
@@ -8,6 +8,7 @@ __status__ = "Production"
 __module_group__ = "Timeline"
 
 import os
+from utils import validUrlPrefix
 
 
 def loadPeertubeInstances(baseDir: str, peertubeInstances: []) -> None:
@@ -110,6 +111,8 @@ def _addEmbeddedVideoFromSites(translate: {}, content: str,
 
     if '"https://' in content:
         if peertubeInstances:
+            # only create an embedded video for a limited set of
+            # peertube sites.
             peerTubeSites = peertubeInstances
         else:
             # A default selection of the current larger peertube sites,
@@ -160,19 +163,21 @@ def _addEmbeddedVideoFromSites(translate: {}, content: str,
             else:
                 siteStr = 'https://' + site
             siteStr = '"' + siteStr
-            if siteStr in content:
-                url = content.split(siteStr)[1]
-                if '"' in url:
-                    url = url.split('"')[0].replace('/watch/', '/embed/')
-                    content = \
-                        content + "<center>\n<iframe loading=\"lazy\" " + \
-                        "sandbox=\"allow-same-origin " + \
-                        "allow-scripts\" src=\"https://" + \
-                        site + url + "\" width=\"" + str(width) + \
-                        "\" height=\"" + str(height) + \
-                        "\" frameborder=\"0\" allow=\"autoplay; " + \
-                        "fullscreen\" allowfullscreen></iframe>\n</center>\n"
-                    return content
+            if siteStr not in content:
+                continue
+            url = content.split(siteStr)[1]
+            if '"' not in url:
+                continue
+            url = url.split('"')[0].replace('/watch/', '/embed/')
+            content = \
+                content + "<center>\n<iframe loading=\"lazy\" " + \
+                "sandbox=\"allow-same-origin " + \
+                "allow-scripts\" src=\"https://" + \
+                site + url + "\" width=\"" + str(width) + \
+                "\" height=\"" + str(height) + \
+                "\" frameborder=\"0\" allow=\"autoplay; " + \
+                "fullscreen\" allowfullscreen></iframe>\n</center>\n"
+            return content
     return content
 
 
@@ -205,19 +210,14 @@ def _addEmbeddedAudio(translate: {}, content: str) -> str:
         if not w.endswith(extension):
             continue
 
-        if not (w.startswith('http') or w.startswith('dat:') or
-                w.startswith('hyper:') or w.startswith('i2p:') or
-                w.startswith('gnunet:') or
-                '/' in w):
+        if not validUrlPrefix(w):
             continue
-        url = w
-        content += '<center>\n<audio controls>\n'
         content += \
-            '<source src="' + url + '" type="audio/' + \
-            extension.replace('.', '') + '">'
-        content += \
-            translate['Your browser does not support the audio element.']
-        content += '</audio>\n</center>\n'
+            '<center>\n<audio controls>\n' + \
+            '<source src="' + w + '" type="audio/' + \
+            extension.replace('.', '') + '">' + \
+            translate['Your browser does not support the audio element.'] + \
+            '</audio>\n</center>\n'
     return content
 
 
@@ -251,23 +251,17 @@ def _addEmbeddedVideo(translate: {}, content: str) -> str:
             w = w[:-1]
         if not w.endswith(extension):
             continue
-        if not (w.startswith('http') or w.startswith('dat:') or
-                w.startswith('hyper:') or w.startswith('i2p:') or
-                w.startswith('gnunet:') or
-                '/' in w):
+        if not validUrlPrefix(w):
             continue
-        url = w
         content += \
             '<center><figure id="videoContainer" ' + \
             'data-fullscreen="false">\n' + \
             '    <video id="video" controls ' + \
-            'preload="metadata">\n'
-        content += \
-            '<source src="' + url + '" type="video/' + \
-            extension.replace('.', '') + '">\n'
-        content += \
-            translate['Your browser does not support the video element.']
-        content += '</video>\n</figure>\n</center>\n'
+            'preload="metadata">\n' + \
+            '<source src="' + w + '" type="video/' + \
+            extension.replace('.', '') + '">\n' + \
+            translate['Your browser does not support the video element.'] + \
+            '</video>\n</figure>\n</center>\n'
     return content