Fixed possible JS injection via the title edition

[github/wallabag/wallabag.git] / src / Wallabag / CoreBundle / Resources / views / themes / material / Entry / entry.html.twig

diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig
index d73d2703b84a8fca7e95e32ed390517c5ca628d1..b445f7d5fabeb9497103987ddd763f7503d29177 100644 (file)
--- a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig
+++ b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig
@@ -1,6 +1,6 @@
 {% extends "WallabagCoreBundle::layout.html.twig" %}
 
-{% block title %}{{ entry.title|raw }} ({{ entry.domainName|removeWww }}){% endblock %}
+{% block title %}{{ entry.title|e|raw }} ({{ entry.domainName|removeWww }}){% endblock %}
 
 {% block body_class %}entry{% endblock %}
 
@@ -47,7 +47,7 @@
 
         <li class="bold border-bottom hide-on-med-and-down">
             <a class="waves-effect collapsible-header" href="{{ entry.url|e }}">
-                <i class="material-icons small">public</i>
+                <i class="material-icons small">link</i>
                 <span>{{ 'entry.view.left_menu.view_original_article'|trans }}</span>
             </a>
             <div class="collapsible-body"></div>
@@ -106,50 +106,50 @@
                 <ul>
                     {% if craue_setting('share_public') %}
                         <li>
-                            <a href="{{ path('share', {'id': entry.id }) }}" target="_blank" title="{{ 'entry.view.left_menu.public_link'|trans }}">
-                                <i class="material-icons">link</i>
+                            <a href="{{ path('share', {'id': entry.id }) }}" target="_blank" title="{{ 'entry.view.left_menu.public_link'|trans }}" class="tool icon-eye">
                                 <span>{{ 'entry.view.left_menu.public_link'|trans }}</span>
                             </a>
                         </li>
                         <li>
-                            <a href="{{ path('delete_share', {'id': entry.id }) }}" class="tool" title="{{ 'entry.view.left_menu.delete_public_link'|trans }}">
-                                <i class="material-icons">remove_circle</i>
+                            <a href="{{ path('delete_share', {'id': entry.id }) }}" title="{{ 'entry.view.left_menu.delete_public_link'|trans }}" class="tool icon-no-eye">
                                 <span>{{ 'entry.view.left_menu.delete_public_link'|trans }}</span>
                             </a>
                         </li>
                     {% endif %}
                     {% if craue_setting('share_twitter') %}
                         <li>
-                            <a href="https://twitter.com/home?status={{entry.title|url_encode}}%20{{ entry.url|url_encode }}%20via%20@wallabagapp" target="_blank" class="tool twitter icon icon-twitter" title="twitter">
+                            <a href="https://twitter.com/home?status={{entry.title|url_encode}}%20{{ entry.url|url_encode }}%20via%20@wallabagapp" target="_blank" class="tool icon-twitter" title="twitter">
                                 <span>twitter</span>
                             </a>
                         </li>
                     {% endif %}
                     {% if craue_setting('share_shaarli') %}
                         <li>
-                            <a href="{{ craue_setting('shaarli_url') }}/index.php?post={{ entry.url|url_encode }}&amp;title={{ entry.title|url_encode }}" target="_blank" class="tool icon-image icon-image--shaarli" title="shaarli">
-                                shaarli
+                            <a href="{{ craue_setting('shaarli_url') }}/index.php?post={{ entry.url|url_encode }}&amp;title={{ entry.title|url_encode }}" target="_blank">
+                                <i class="tool icon-image icon-image--shaarli" title="shaarli"></i>
+                                <span>shaarli</span>
                             </a>
                         </li>
                     {% endif %}
                     {% if craue_setting('share_diaspora') %}
                         <li>
-                            <a href="{{ craue_setting('diaspora_url') }}/bookmarklet?url={{ entry.url|url_encode }}&title={{ entry.title|url_encode }}&notes=&v=1&noui=1&jump=doclose" target="_blank" class="tool diaspora icon-image icon-image--diaspora" title="diaspora">
-                                diaspora*
+                            <a href="{{ craue_setting('diaspora_url') }}/bookmarklet?url={{ entry.url|url_encode }}&title={{ entry.title|url_encode }}&notes=&v=1&noui=1&jump=doclose" target="_blank">
+                                <i class="tool icon-image icon-image--diaspora" title="diaspora"></i>
+                                <span>diaspora*</span>
                             </a>
                         </li>
                     {% endif %}
                     {% if craue_setting('carrot') %}
                         <li>
-                            <a href="https://secure.carrot.org/GiveAndGetBack.do?url={{ entry.url|url_encode }}&title={{ entry.title|url_encode }}" target="_blank" title="carrot" class="tool carrot icon-image icon-image--carrot">
-                                Carrot
+                            <a href="https://secure.carrot.org/GiveAndGetBack.do?url={{ entry.url|url_encode }}&title={{ entry.title|url_encode }}" target="_blank" title="carrot">
+                                <i class="tool icon-image icon-image--carrot"></i>
+                                <span>Carrot</span>
                             </a>
                         </li>
                     {% endif %}
                     {% if craue_setting('share_mail') %}
                         <li>
-                            <a href="mailto:?subject={{ entry.title|url_encode }}&amp;body={{ entry.url|url_encode }}%20via%20@wallabagapp" title="{{ 'entry.view.left_menu.share_email_label'|trans }}">
-                                <i class="material-icons">email</i>
+                            <a href="mailto:?subject={{ entry.title|url_encode }}&amp;body={{ entry.url|url_encode }}%20via%20@wallabagapp" title="{{ 'entry.view.left_menu.share_email_label'|trans }}" class="tool email icon icon-mail">
                                 <span>{{ 'entry.view.left_menu.share_email_label'|trans }}</span>
                             </a>
                         </li>
@@ -209,29 +209,41 @@
 {% block content %}
     <div id="article">
         <header class="mbm">
-            <h1>{{ entry.title|raw }} <a href="{{ path('edit', { 'id': entry.id }) }}" title="{{ 'entry.view.edit_title'|trans }}">✎</a></h1>
+            <h1>{{ entry.title|e|raw }} <a href="{{ path('edit', { 'id': entry.id }) }}" title="{{ 'entry.view.edit_title'|trans }}">✎</a></h1>
         </header>
         <aside>
-            {% set readingTime = entry.readingTime / app.user.config.readingSpeed %}
-            <i class="material-icons">timer</i>
-            <span class="link">
-                {% if readingTime > 0 %}
-                    {{ 'entry.list.reading_time_minutes_short'|trans({'%readingTime%': readingTime|round}) }}
-                {% else %}
-                    {{ 'entry.list.reading_time_less_one_minute_short'|trans|raw }}
-                {% endif %}
-            </span>
-            <i class="material-icons" title="{{ 'entry.view.created_at'|trans }}">today</i><span class="link">{{ entry.createdAt|date('Y-m-d') }}</span>
-            <a href="{{ entry.url|e }}" target="_blank" title="{{ 'entry.view.original_article'|trans }} : {{ entry.title|e }}" class="tool">
-            <i class="material-icons link">link</i> <span class="link">{{ entry.domainName|removeWww }}</span></a>
-            <span class="tool"><i class="material-icons link">comment</i> <span class="link">{{ 'entry.view.annotations_on_the_entry'|transchoice(entry.annotations | length) }}</span>
-            <div id="list">
-                {% for tag in entry.tags %}
-                    <div class="chip">
-                    {{ tag.label }} <a href="{{ path('remove_tag', { 'entry': entry.id, 'tag': tag.id }) }}"><i class="material-icons">delete</i></a>
-                    </div>
-                {% endfor %}
-            </div>
+            <ul class="tools">
+                <li>
+                    {% set readingTime = entry.readingTime / app.user.config.readingSpeed %}
+                    <i class="material-icons">timer</i>
+                    {% if readingTime > 0 %}
+                        {{ 'entry.list.reading_time_minutes_short'|trans({'%readingTime%': readingTime|round}) }}
+                    {% else %}
+                        {{ 'entry.list.reading_time_less_one_minute_short'|trans|raw }}
+                    {% endif %}
+                </li>
+                <li>
+                    <i class="material-icons" title="{{ 'entry.view.created_at'|trans }}">today</i>
+                    {{ entry.createdAt|date('Y-m-d') }}
+                </li>
+                <li>
+                    <i class="material-icons link">link</i>
+                    <a href="{{ entry.url|e }}" target="_blank" title="{{ 'entry.view.original_article'|trans }} : {{ entry.title|e }}" class="tool">
+                        {{ entry.domainName|removeWww }}
+                    </a>
+                </li>
+                <li>
+                    <i class="material-icons link">comment</i>
+                    {{ 'entry.view.annotations_on_the_entry'|transchoice(entry.annotations | length) }}
+                </li>
+                <li id="list">
+                    {% for tag in entry.tags %}
+                        <div class="chip">
+                        <a href="{{ path('tag_entries', {'slug': tag.slug}) }}">{{ tag.label }}</a> <a href="{{ path('remove_tag', { 'entry': entry.id, 'tag': tag.id }) }}"><i class="material-icons">delete</i></a>
+                        </div>
+                    {% endfor %}
+                </li>
+            </ul>
 
             <div class="input-field nav-panel-add-tag" style="display: none">
                 {{ render(controller( "WallabagCoreBundle:Tag:addTagForm", { 'id': entry.id } )) }}