Function for checking url prefixes

utils.py

@@ -2536,3 +2536,15 @@ def getPortFromDomain(domain: str) -> int:
         if portStr.isdigit():
             return int(portStr)
     return None
+
+
+def validUrlPrefix(url: str) -> bool:
+    """Does the given url have a valid prefix?
+    """
+    if '/' not in url:
+        return False
+    prefixes = ('https:', 'http:', 'hyper:', 'i2p:', 'gnunet:')
+    for pre in prefixes:
+        if url.startswith(pre):
+            return True
+    return False

webapp_headerbuttons.py

@@ -54,8 +54,7 @@ def headerButtonsTimeline(defaultTimeline: str,
     # first button
     if defaultTimeline == 'tlmedia':
         tlStr += \
-            '<a href="' + usersPath + \
+            '<a href="' + usersPath + '/tlmedia" tabindex="-1" ' + \
-            '/tlmedia" tabindex="-1" ' + \
             'accesskey="' + accessKeys['menuMedia'] + '"' + \
             '><button class="' + \
             mediaButton + '"><span>' + translate['Media'] + \
@@ -105,8 +104,7 @@ def headerButtonsTimeline(defaultTimeline: str,
     if defaultTimeline != 'tlmedia':
         if not minimal and not featuresHeader:
             tlStr += \
-                '<a href="' + usersPath + \
+                '<a href="' + usersPath + '/tlmedia" tabindex="-1" ' + \
-                '/tlmedia" tabindex="-1" ' + \
                 'accesskey="' + accessKeys['menuMedia'] + '">' + \
                 '<button class="' + \
                 mediaButton + '"><span>' + translate['Media'] + \
@@ -206,10 +204,8 @@ def headerButtonsTimeline(defaultTimeline: str,
     if not featuresHeader:
         # button for the outbox
         tlStr += \
-            '<a href="' + usersPath + \
+            '<a href="' + usersPath + '/outbox"><button class="' + \
-            '/outbox"><button class="' + \
+            sentButton + '" tabindex="-1"><span>' + translate['Sent'] + \
-            sentButton + '" tabindex="-1">' + \
-            '<span>' + translate['Sent'] + \
             '</span></button></a>'
 
         # add other buttons

webapp_login.py

@@ -36,7 +36,8 @@ def htmlGetLoginCredentials(loginParams: str,
     password = None
     register = False
     for arg in loginArgs:
-        if '=' in arg:
+        if '=' not in arg:
+            continue
         if arg.split('=', 1)[0] == 'username':
             nickname = arg.split('=', 1)[1]
             if nickname.startswith('@'):
@@ -103,8 +104,7 @@ def htmlLogin(cssCache: {}, translate: {},
     else:
         loginText = \
             '<p class="login-text">' + \
-            translate['Please enter some credentials'] + '</p>'
+            translate['Please enter some credentials'] + '</p>' + \
-        loginText += \
             '<p class="login-text">' + \
             translate['You will become the admin of this site.'] + \
             '</p>'
@@ -132,8 +132,7 @@ def htmlLogin(cssCache: {}, translate: {},
 
     TOSstr = \
         '<p class="login-text"><a href="/about">' + \
-        translate['About this Instance'] + '</a></p>'
+        translate['About this Instance'] + '</a></p>' + \
-    TOSstr += \
         '<p class="login-text"><a href="/terms">' + \
         translate['Terms of Service'] + '</a></p>'
 
@@ -153,34 +152,32 @@ def htmlLogin(cssCache: {}, translate: {},
         htmlHeaderWithWebsiteMarkup(cssFilename, instanceTitle,
                                     httpPrefix, domain,
                                     systemLanguage)
-    loginForm += '<br>\n'
-    loginForm += '<form method="POST" action="/login">\n'
-    loginForm += '  <div class="imgcontainer">\n'
     instanceTitle = getConfigParam(baseDir, 'instanceTitle')
-    loginForm += textModeLogoHtml + '\n'
     loginForm += \
+        '<br>\n' + \
+        '<form method="POST" action="/login">\n' + \
+        '  <div class="imgcontainer">\n' + \
+        textModeLogoHtml + '\n' + \
         '    <img loading="lazy" src="' + loginImage + \
-        '" alt="' + instanceTitle + '" class="loginimage">\n'
+        '" alt="' + instanceTitle + '" class="loginimage">\n' + \
-    loginForm += loginText + TOSstr + '\n'
+        loginText + TOSstr + '\n' + \
-    loginForm += '  </div>\n'
+        '  </div>\n' + \
-    loginForm += '\n'
+        '\n' + \
-    loginForm += '  <div class="container">\n'
+        '  <div class="container">\n' + \
-    loginForm += '    <label for="nickname"><b>' + \
+        '    <label for="nickname"><b>' + \
-        translate['Nickname'] + '</b></label>\n'
+        translate['Nickname'] + '</b></label>\n' + \
-    loginForm += \
         '    <input type="text" ' + autocompleteStr + ' placeholder="' + \
-        translate['Enter Nickname'] + '" name="username" required autofocus>\n'
+        translate['Enter Nickname'] + \
-    loginForm += '\n'
+        '" name="username" required autofocus>\n' + \
-    loginForm += '    <label for="password"><b>' + \
+        '\n' + \
-        translate['Password'] + '</b></label>\n'
+        '    <label for="password"><b>' + \
-    loginForm += \
+        translate['Password'] + '</b></label>\n' + \
         '    <input type="password" ' + autocompleteStr + \
         ' placeholder="' + translate['Enter Password'] + \
-        '" name="password" required>\n'
+        '" name="password" required>\n' + \
-    loginForm += loginButtonStr + registerButtonStr + '\n'
+        loginButtonStr + registerButtonStr + '\n' + \
-    loginForm += '  </div>\n'
+        '  </div>\n' + \
-    loginForm += '</form>\n'
+        '</form>\n' + \
-    loginForm += \
         '<a href="https://gitlab.com/bashrc2/epicyon">' + \
         '<img loading="lazy" class="license" title="' + \
         translate['Get the source code'] + '" alt="' + \

webapp_media.py

@@ -8,6 +8,7 @@ __status__ = "Production"
 __module_group__ = "Timeline"
 
 import os
+from utils import validUrlPrefix
 
 
 def loadPeertubeInstances(baseDir: str, peertubeInstances: []) -> None:
@@ -110,6 +111,8 @@ def _addEmbeddedVideoFromSites(translate: {}, content: str,
 
     if '"https://' in content:
         if peertubeInstances:
+            # only create an embedded video for a limited set of
+            # peertube sites.
             peerTubeSites = peertubeInstances
         else:
             # A default selection of the current larger peertube sites,
@@ -160,9 +163,11 @@ def _addEmbeddedVideoFromSites(translate: {}, content: str,
             else:
                 siteStr = 'https://' + site
             siteStr = '"' + siteStr
-            if siteStr in content:
+            if siteStr not in content:
+                continue
             url = content.split(siteStr)[1]
-                if '"' in url:
+            if '"' not in url:
+                continue
             url = url.split('"')[0].replace('/watch/', '/embed/')
             content = \
                 content + "<center>\n<iframe loading=\"lazy\" " + \
@@ -205,19 +210,14 @@ def _addEmbeddedAudio(translate: {}, content: str) -> str:
         if not w.endswith(extension):
             continue
 
-        if not (w.startswith('http') or w.startswith('dat:') or
+        if not validUrlPrefix(w):
-                w.startswith('hyper:') or w.startswith('i2p:') or
-                w.startswith('gnunet:') or
-                '/' in w):
             continue
-        url = w
-        content += '<center>\n<audio controls>\n'
         content += \
-            '<source src="' + url + '" type="audio/' + \
+            '<center>\n<audio controls>\n' + \
-            extension.replace('.', '') + '">'
+            '<source src="' + w + '" type="audio/' + \
-        content += \
+            extension.replace('.', '') + '">' + \
-            translate['Your browser does not support the audio element.']
+            translate['Your browser does not support the audio element.'] + \
-        content += '</audio>\n</center>\n'
+            '</audio>\n</center>\n'
     return content
 
 
@@ -251,23 +251,17 @@ def _addEmbeddedVideo(translate: {}, content: str) -> str:
             w = w[:-1]
         if not w.endswith(extension):
             continue
-        if not (w.startswith('http') or w.startswith('dat:') or
+        if not validUrlPrefix(w):
-                w.startswith('hyper:') or w.startswith('i2p:') or
-                w.startswith('gnunet:') or
-                '/' in w):
             continue
-        url = w
         content += \
             '<center><figure id="videoContainer" ' + \
             'data-fullscreen="false">\n' + \
             '    <video id="video" controls ' + \
-            'preload="metadata">\n'
+            'preload="metadata">\n' + \
-        content += \
+            '<source src="' + w + '" type="video/' + \
-            '<source src="' + url + '" type="video/' + \
+            extension.replace('.', '') + '">\n' + \
-            extension.replace('.', '') + '">\n'
+            translate['Your browser does not support the video element.'] + \
-        content += \
+            '</video>\n</figure>\n</center>\n'
-            translate['Your browser does not support the video element.']
-        content += '</video>\n</figure>\n</center>\n'
     return content