[Web Interface] Fix HTML injection via "currently playing"

- Would have been exploitable with malicious titles in youtube, etc.

diff --git a/interface.py b/interface.py
index 2a903b95b0e75ae04b0719d46927648e6482aeb7..26e0316881d161e511499ad6efca3e1f15341372 100644 (file)
--- a/interface.py
+++ b/interface.py
@@ -98,21 +98,29 @@ def index():
                 random.shuffle(var.playlist)
     if var.current_music:
         source = var.current_music[0]
+        # format for current_music below:
+        # (sourcetype, title, url or None)
         if source == "radio":
-            current_music = "[radio] {title} sur {url}".format(
-                title=media.get_radio_title(var.current_music[1]),
-                url=var.current_music[2]
+            current_music = (
+                "[radio]",
+                media.get_radio_title(var.current_music[1]),
+                var.current_music[2]
             )
         elif source == "url":
-            current_music = "[url] {title} (<a href=\"{url}\">{url}</a>)".format(
-                title=var.current_music[2],
-                url=var.current_music[1]
+            current_music = (
+                "[url]",
+                var.current_music[2],
+                var.current_music[1]
             )
         elif source == "file":
-            current_music = "[file] {title}".format(title=var.current_music[2])
+            current_music = (
+                "[file]",
+                var.current_music[2],
+                None
+            )
         else:
-            current_music = "(?)[{}] {} {}".format(
-                var.current_music[0],
+            current_music = (
+                "(??)[" + var.current_music[0] + "]",
                 var.current_music[1],
                 var.current_music[2],
             )

diff --git a/templates/index.html b/templates/index.html
index fc2ef7c0e27ce66bd2a5b9b182d96574b92a5bd1..ef8178d28a7001c0420cba4cbe1a0e2ea913d812 100644 (file)
--- a/templates/index.html
+++ b/templates/index.html
@@ -77,7 +77,10 @@
 <div id="playlist">
     Currently Playing :
     {% if current_music %}
-    {{ current_music|safe }}
+    {{ current_music[0] }} {{ current_music[1] }}
+    {% if current_music[2] %}
+        (<a href="{{ current_music[2] }}">{{ current_music[2] }}</a>)
+    {% endif %}
     {% else %}
     No music
     {% endif %}