From: Roger Braun <roger@rogerbraun.net>
Date: Sun, 18 Jun 2017 11:17:35 +0000 (+0200)
Subject: Remove html from user bios on display.
X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=7b41e103e1146ed2912cd2c336079947fef71e9a;p=akkoma

Remove html from user bios on display.

This is mainly to fix problems of bios coming from mastodong.
---

diff --git a/lib/pleroma/web/twitter_api/representers/user_representer.ex b/lib/pleroma/web/twitter_api/representers/user_representer.ex
index 8a7bb6f0d..a6595f349 100644
--- a/lib/pleroma/web/twitter_api/representers/user_representer.ex
+++ b/lib/pleroma/web/twitter_api/representers/user_representer.ex
@@ -18,7 +18,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.UserRepresenter do
       "id" => user.id,
       "name" => user.name,
       "screen_name" => user.nickname,
-      "description" => user.bio,
+      "description" => HtmlSanitizeEx.strip_tags(user.bio),
       "following" => following,
       "created_at" => created_at,
       # Fake fields
diff --git a/test/web/twitter_api/representers/user_representer_test.exs b/test/web/twitter_api/representers/user_representer_test.exs
index d63f738a9..f62ce1da3 100644
--- a/test/web/twitter_api/representers/user_representer_test.exs
+++ b/test/web/twitter_api/representers/user_representer_test.exs
@@ -8,7 +8,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.UserRepresenterTest do
   import Pleroma.Factory
 
   setup do
-    user = insert(:user)
+    user = insert(:user, bio: "<span>Here's some html</span>")
     [user: user]
   end
 
@@ -39,7 +39,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.UserRepresenterTest do
       "id" => user.id,
       "name" => user.name,
       "screen_name" => user.nickname,
-      "description" => user.bio,
+      "description" => HtmlSanitizeEx.strip_tags(user.bio),
       "created_at" => created_at,
       # Fake fields
       "favourites_count" => 0,
@@ -66,7 +66,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.UserRepresenterTest do
       "id" => user.id,
       "name" => user.name,
       "screen_name" => user.nickname,
-      "description" => user.bio,
+      "description" => HtmlSanitizeEx.strip_tags(user.bio),
       "created_at" => created_at,
       # Fake fields
       "favourites_count" => 0,