diff --git a/app/js/common/version.js b/app/js/common/version.js index c25fc035..b45088be 100644 --- a/app/js/common/version.js +++ b/app/js/common/version.js @@ -190,7 +190,7 @@ function verck(ver) { } } if(show){ - Materialize.toast(obj.Text+toot+'(スライドして消去)', 86400); + Materialize.toast(escapeHTML(obj.Text)+toot+'(スライドして消去)', 86400); } } @@ -211,9 +211,6 @@ function infowebsocket(){ console.log(JSON.parse(mess.data)); var obj=JSON.parse(mess.data); if(obj.type!="counter"){ - if(obj.id*1<=localStorage.getItem("last-notice-id")){ - - }else{ localStorage.setItem("last-notice-id",obj.id) var show=true; if(obj.toot!=""){ @@ -242,9 +239,8 @@ function infowebsocket(){ } } if(show){ - Materialize.toast(obj.text+toot+'(スライドして消去)', 86400); + Materialize.toast(escapeHTML(obj.Text)+toot+'(スライドして消去)', 86400); } - } }else{ $("#persons").text(obj.text); } diff --git a/app/js/login/manager.js b/app/js/login/manager.js index efaf09b2..6c17a406 100644 --- a/app/js/login/manager.js +++ b/app/js/login/manager.js @@ -542,7 +542,7 @@ function getdata(domain, at) { console.log(json); if (json.error) { console.error("Error:" + json.error); - Materialize.toast(lang.lang_fatalerroroccured+"Error:" + json.error, + Materialize.toast(lang.lang_fatalerroroccured+"Error:" + escapeHTML(json.error), 5000); return; } @@ -817,7 +817,7 @@ input.addEventListener("focus", function() { Object.keys(json.instances).forEach(function(key) { var url = json.instances[key]; urls = urls + '　' + url.name + ' '; + '\')" class="pointer">' +escapeHTML(url.name) + ' '; }); $("#ins-suggest").html(urls); } diff --git a/app/js/platform/first.js b/app/js/platform/first.js index a95edd06..4f1525d4 100644 --- a/app/js/platform/first.js +++ b/app/js/platform/first.js @@ -62,7 +62,7 @@ function formattime(date){ }else{ str=str+date.getMinutes() } - return str; + return escapeHTML(str); } function formattimeutc(date){ var str=date.getUTCFullYear()+"-"; @@ -87,7 +87,7 @@ function formattimeutc(date){ }else{ str=str+date.getUTCMinutes() } - return str; + return escapeHTML(str); } var electron = require("electron"); var ipc = electron.ipcRenderer; diff --git a/app/js/post/emoji.js b/app/js/post/emoji.js index 5f571c46..19038798 100644 --- a/app/js/post/emoji.js +++ b/app/js/post/emoji.js @@ -35,7 +35,7 @@ function emojiToggle(reaction) { //絵文字リスト挿入 function emojiGet(parse, started) { - $('#emoji-list').html('Loading...'); + $('#emoji-list').text('Loading...'); var acct_id = $("#post-acct-sel").val(); var domain = localStorage.getItem("domain_" + acct_id); if (localStorage.getItem("mode_" + domain) != "misskey") { @@ -52,7 +52,7 @@ function emojiGet(parse, started) { console.error(error); }).then(function (json) { if (parse == "true") { - $('#emoji-list').html('Parsing...'); + $('#emoji-list').text('Parsing...'); //絵文字をマストドン公式と同順にソート json.sort(function (a, b) { if (a.shortcode < b.shortcode) return -1; @@ -96,7 +96,7 @@ function emojiGet(parse, started) { }) }); if (parse == "true") { - $('#emoji-list').html('Parsing...'); + $('#emoji-list').text('Parsing...'); //絵文字をマストドン公式と同順にソート md.sort(function (a, b) { if (a.shortcode < b.shortcode) return -1; diff --git a/app/js/post/misskeystatus.js b/app/js/post/misskeystatus.js index 84366e83..ef78f07f 100644 --- a/app/js/post/misskeystatus.js +++ b/app/js/post/misskeystatus.js @@ -234,7 +234,7 @@ function voterefresh(acct_id,id){ }else{ var myvote=""; } - poll=poll+'
'+choice.text+'('+choice.votes+''+myvote+')
'; + poll=poll+'
'+escapeHTML(choice.text)+'('+choice.votes+''+myvote+')
'; }); $(".vote_"+json.id).html(poll) } diff --git a/app/js/post/post.js b/app/js/post/post.js index e6a47ee1..c1b1a34f 100644 --- a/app/js/post/post.js +++ b/app/js/post/post.js @@ -298,7 +298,7 @@ function clear() { $("#post-acct-sel").prop("disabled", false); $("#days_poll").val(0); $("#hours_poll").val(0); - $("#mins_poll").val(0); + $("#mins_poll").val(6); $(".mastodon-choice").map(function() { $(this).val(""); }); diff --git a/app/js/post/suggest.js b/app/js/post/suggest.js index fcd502e0..ba5a9188 100644 --- a/app/js/post/suggest.js +++ b/app/js/post/suggest.js @@ -169,7 +169,7 @@ function cgNPs(q){ var tags = ""; Object.keys(json).forEach(function(key4) { var tag = json[key4]; - tags = tags + '' + json[key4] + ' '; + tags = tags + '' + escapeHTML(json[key4]) + ' '; }); $("#suggest").html("Cinderella NowPlaying:" + tags); }else{ diff --git a/app/js/tl/card.js b/app/js/tl/card.js index b6c1395e..1b638c14 100644 --- a/app/js/tl/card.js +++ b/app/js/tl/card.js @@ -63,8 +63,8 @@ function additional(acct_id, tlid) { }).then(function(json) { if (json.title) { $("[toot-id=" + id + "] .additional").html( - "URL"+lang.lang_cards_check+":
Title:" + json.title + "
" + - json.description + ""); + "URL"+lang.lang_cards_check+":
Title:" + escapeHTML(json.title) + "
" + + escapeHTML(json.description) + ""); $("[toot-id=" + id + "] a:not(.parsed)").addClass("parsed"); $("[toot-id=" + id + "]").addClass("parsed"); } @@ -148,8 +148,8 @@ function additionalIndv(tlid, acct_id, id) { }).then(function(json) { if (json.title) { $("[toot-id=" + id + "] .additional").html( - "URL"+lang.lang_cards_check+":
Title:" + json.title + "
" + - json.description + ""); + "URL"+lang.lang_cards_check+":
Title:" + escapeHTML(json.title) + "
" + + escapeHTML(json.description) + ""); $("[toot-id=" + id + "] a:not(.parsed)").addClass("parsed"); $("[toot-id=" + id + "]").addClass("parsed"); } diff --git a/app/js/tl/dm.js b/app/js/tl/dm.js index c434c1ef..657b0d3a 100644 --- a/app/js/tl/dm.js +++ b/app/js/tl/dm.js @@ -251,7 +251,7 @@ function dmListParse(obj, mix, acct_id, tlid, popup, mutefilter) { var via = ''; viashow="hide"; } else { - var via = toot.application.name; + var via = escapeHTML(toot.application.name); //強調チェック Object.keys(emp).forEach(function(key6) { var cli = emp[key6]; @@ -432,7 +432,7 @@ function dmListParse(obj, mix, acct_id, tlid, popup, mutefilter) { if(word){ var word=word.tag; var regExp = new RegExp( word, "g" ) ; - content=content.replace(regExp,''+word+""); + content=content.replace(regExp,''+escapeHTML(word)+""); } }); } @@ -483,7 +483,7 @@ function dmListParse(obj, mix, acct_id, tlid, popup, mutefilter) { for( var i=0; i '+value.name+''; + var tickerdom='
'+escapeHTML(value.name)+'
'; break; } } diff --git a/app/js/tl/list.js b/app/js/tl/list.js index 73be7ce7..109dee45 100644 --- a/app/js/tl/list.js +++ b/app/js/tl/list.js @@ -30,7 +30,7 @@ function list(){ var lists = ""; Object.keys(json).forEach(function(key) { var list = json[key]; - lists = lists + list.title+':'+lang.lang_list_show+'
'; }); $("#lists").html(lists); @@ -57,7 +57,7 @@ function list(){ var lists = ""; Object.keys(json).forEach(function(key) { var list = json[key]; - lists = lists + list.title+':'+lang.lang_list_show+'/'+lang.lang_list_users+'
'; }); @@ -193,7 +193,7 @@ function hisList(user,acct_id){ Object.keys(json).forEach(function(key) { var list = json[key]; lists = lists + ''+list.title+'
'; + '\')" class="pointer">'+escapeHTML(list.title)+'
'; }); $("#his-lists-b").html(lists); }else{ @@ -217,7 +217,7 @@ function hisList(user,acct_id){ var lists = ""; Object.keys(json).forEach(function(key) { var list = json[key]; - lists = lists + list.title+':'+lang.lang_list_show+'/'+lang.lang_list_add+lang.lang_list_add_misskey+'
'; }); diff --git a/app/js/tl/misskeyparse.js b/app/js/tl/misskeyparse.js index 761e4d96..2d6caeba 100644 --- a/app/js/tl/misskeyparse.js +++ b/app/js/tl/misskeyparse.js @@ -286,7 +286,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { } var if_notf='data-notfIndv="'+acct_id+"_"+toot.id+'"'; var toot = toot.note; - var dis_name=escapeHTMLtemp(toot.user.name); + var dis_name=escapeHTML(toot.user.name); }else{ var if_notf=""; if (toot.renote) { @@ -299,7 +299,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { if(!toot.text){ var toot = toot.renote; } - var dis_name=escapeHTMLtemp(toot.user.name); + var dis_name=escapeHTML(toot.user.name); var uniqueid=toot.id; var actemojick=false } else { @@ -342,7 +342,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { if(toot.viaMobile){ var via = 'Mobile'; }else{ - var via = 'Unknown'; + var via = ''; } } else { var via = toot.app.name; @@ -362,7 +362,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { }); } if ((toot.cw || toot.cw=="") && cw) { - var content = toot.text; + var content = escapeHTML(toot.text); var spoil = escapeHTMLtemp(toot.cw); var spoiler = "cw cw_hide_" + toot.id; var api_spoil = "gray"; @@ -618,7 +618,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { for( var i=0; i '+value.name+''; + var tickerdom='
'+escapeHTML(value.name)+'
'; break; } } @@ -634,7 +634,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { }else{ var myvote=""; } - poll=poll+'
'+choice.text+'('+choice.votes+''+myvote+')
'; + poll=poll+'
'+escapeHTML(choice.text)+'('+choice.votes+''+myvote+')
'; }); poll='
'+poll+'
'; } @@ -841,7 +841,7 @@ function misskeyParse(obj, mix, acct_id, tlid, popup, mutefilter) { acct_id + ')" class="waves-effect waves-dark btn-flat" style="padding:0" title="'+lang.lang_parse_redraft+'">redo'+trans+ 'via ' + - via + + escapeHTML(via) + ''+ '
expand_more
' + '
' + diff --git a/app/js/tl/parse.js b/app/js/tl/parse.js index 84ac8c15..a41406eb 100644 --- a/app/js/tl/parse.js +++ b/app/js/tl/parse.js @@ -766,7 +766,7 @@ function parse(obj, mix, acct_id, tlid, popup, mutefilter, type) { for( var i=0; i '+value.name+'
'; + var tickerdom='
'+escapeHTML(value.name)+'
'; break; } } @@ -1000,7 +1000,7 @@ function client(name) { if(!obj){ var obj=[]; obj.push(name); - Materialize.toast(name+lang.lang_status_emphas, 2000); + Materialize.toast(escapeHTML(name)+lang.lang_status_emphas, 2000); }else{ var can; Object.keys(obj).forEach(function(key) { @@ -1010,12 +1010,12 @@ function client(name) { }else{ can=true; obj.splice(key, 1); - Materialize.toast(name+lang.lang_status_unemphas, 2000); + Materialize.toast(escapeHTML(name)+lang.lang_status_unemphas, 2000); } }); if(!can){ obj.push(name); - Materialize.toast(name+lang.lang_status_emphas, 2000); + Materialize.toast(escapeHTML(name)+lang.lang_status_emphas, 2000); }else{ } @@ -1031,7 +1031,7 @@ function client(name) { obj.push(name); var json = JSON.stringify(obj); localStorage.setItem("client_mute", json); - Materialize.toast(name+lang.lang_parse_mute, 2000); + Materialize.toast(escapeHTML(name)+lang.lang_parse_mute, 2000); }else{ return; } diff --git a/app/js/tl/src.js b/app/js/tl/src.js index 7f6bcbb6..f788afe7 100644 --- a/app/js/tl/src.js +++ b/app/js/tl/src.js @@ -52,7 +52,7 @@ function src(mode) { var tag = json.hashtags[key4]; if(mode){ tags = tags + '#' + tag + '
'; + '\',\'add\')" class="pointer">#' + escapeHTML(tag) + '
'; }else{ tags=tags+graphDraw(tag); } @@ -186,13 +186,13 @@ function graphDraw(tag){ var zero=50-(his[0].uses/max*50); if(max===0){ tags = '

'+ - ''+his[0].uses+'toots #' + tag.name + ' '+his[0].accounts+lang.lang_src_people; + ''+his[0].uses+'toots #' + escapeHTML(tag.name) + ' '+his[0].accounts+lang.lang_src_people; }else{ tags = '

'+ ''+ - ''+his[0].uses+'toots #' + tag.name + ' '+his[0].accounts+lang.lang_src_people; + ''+his[0].uses+'toots #' + escapeHTML(tag.name) + ' '+his[0].accounts+lang.lang_src_people; } return tags; diff --git a/app/js/tl/tag.js b/app/js/tl/tag.js index dbe046fc..0c7eda77 100644 --- a/app/js/tl/tag.js +++ b/app/js/tl/tag.js @@ -65,6 +65,7 @@ function favTag(){ var ptt=lang.lang_tags_unrealtime; var nowon="("+lang.lang_tags_realtime+")"; } + tag=escapeHTML(tag); tags = tags + '#' + tag + ''+nowon+'　TL　Toot　'+ ''+ptt+'　'+lang.lang_del+' '; }); @@ -96,6 +97,7 @@ function trendTag(){ var tags=""; json=json.score; Object.keys(json).forEach(function(tag) { + tag=escapeHTML(tag); tags = tags + '#' + tag + '　TL　Toot '; }); $("#taglist").append('
アイマストドントレンドタグrefresh:' + tags+'
'); @@ -115,6 +117,7 @@ function tagTL(a,b,c,d){ tl(a,b,acct_id,d); } function autoToot(tag){ + tag=escapeHTML(tag) var nowPT=localStorage.getItem("stable") if(nowPT==tag){ localStorage.removeItem("stable"); diff --git a/app/js/tl/tl.js b/app/js/tl/tl.js index 9357895c..707d9880 100644 --- a/app/js/tl/tl.js +++ b/app/js/tl/tl.js @@ -660,7 +660,7 @@ function cap(type, data, acct_id) { var response="Federated TL(Media)"; } } else if (type == "tag") { - var response= "#" + data + var response= "#" + escapeHTML(data) } else if (type == "list") { var ltitle=localStorage.getItem("list_"+data+"_"+acct_id); var response= "List(" + ltitle + ")" @@ -685,7 +685,7 @@ function cap(type, data, acct_id) { }else if (type == "webview") { var response="Twitter" }else if (type == "tootsearch") { - var response="tootsearch(" + data + ")"; + var response="tootsearch(" + escapeHTML(data) + ")"; } return response; } diff --git a/app/js/ui/layout.js b/app/js/ui/layout.js index b37f12ae..3716e92c 100644 --- a/app/js/ui/layout.js +++ b/app/js/ui/layout.js @@ -28,6 +28,9 @@ function parseColumn() { $(".toot-reset").css("font-size", size + "px"); $(".cont-series").css("font-size", size + "px"); } + if(localStorage.getItem("menu-done")){ + $("#fukidashi").addClass("hide") + } tlCloser(); var multi = localStorage.getItem("multi"); if (multi) { @@ -198,7 +201,7 @@ function parseColumn() { key + '">On'+lang.lang_layout_linkana +'
hearingOn'+lang.lang_layout_tts +'TL
low_priority'+lang.lang_layout_reconnect+'
'+lang.lang_layout_headercolor +'
low_priority'+lang.lang_layout_reconnect+'
'+lang.lang_layout_headercolor +'
'+lang.lang_layout_nodata +'
' $('#timeline_box_' + basekey + '_parentBox').append(html); localStorage.removeItem("pool_" + key); diff --git a/app/js/ui/menu.js b/app/js/ui/menu.js index 429fba4e..0c46ae93 100644 --- a/app/js/ui/menu.js +++ b/app/js/ui/menu.js @@ -1,4 +1,6 @@ function menu(){ + localStorage.setItem("menu-done",true); + $("#fukidashi").addClass("hide") if(!$("#menu").hasClass("appear")){ $("#menu").addClass("appear") var left=localStorage.getItem("menu-left"); diff --git a/app/js/ui/sort.js b/app/js/ui/sort.js index 8286d16b..0d350657 100644 --- a/app/js/ui/sort.js +++ b/app/js/ui/sort.js @@ -32,7 +32,7 @@ function sortload(){ var acctdata=user+"@"+domain; } - var html='
  • '+icon(acct.type)+'
    '+cap(acct.type, acct.data,acct.domain)+'
    '+icon(acct.type)+'
    '+cap(acct.type, escapeHTML(acct.data),acct.domain)+'
    forward cancel
    '+acctdata+'
    • '; $("#sort").append(html); @@ -103,7 +103,7 @@ function sort(){ var json = JSON.stringify(newobj); localStorage.setItem("column", json); $("#sort").html(""); - Materialize.toast("並べ替え完了。", 3000); + Materialize.toast("Sorted", 3000); sortload(); parseColumn(); sortMenu() diff --git a/app/js/ui/tips.js b/app/js/ui/tips.js index a1d735be..e7871c7e 100644 --- a/app/js/ui/tips.js +++ b/app/js/ui/tips.js @@ -57,7 +57,7 @@ function startmem(){ var use=arg[0]; var cpu=arg[1]; var total=arg[2] - $("#tips-text").html(cpu+"
    Memory:"+Math.floor(use/1024/1024/102.4)/10+"/"+Math.floor(total/1024/1024/102.4)/10+"GB("+Math.floor(use/total*100)+"%)") + $("#tips-text").html(escapeHTML(cpu)+"
    Memory:"+Math.floor(use/1024/1024/102.4)/10+"/"+Math.floor(total/1024/1024/102.4)/10+"GB("+Math.floor(use/total*100)+"%)") }) } //トレンドタグ @@ -83,7 +83,7 @@ function trendTagonTip(){ var tags=""; json=json.score; Object.keys(json).forEach(function(tag) { - tags = tags + '#' + tag + '　TL　Toot
    '; + tags = tags + '#' + escapeHTML(tag) + '　TL　Toot
    '; }); $("#tips-text").html('
    トレンドタグrefresh:
    ' + tags+'
    '); trendTagonTipInterval() diff --git a/app/js/userdata/his-data.js b/app/js/userdata/his-data.js index 851b20cd..2ddede9f 100644 --- a/app/js/userdata/his-data.js +++ b/app/js/userdata/his-data.js @@ -571,9 +571,9 @@ function udAdd(start) { for(var i=0;i'+fields[i].signatureAlgorithm+':'+fields[i].name+''; + var html=''+escapeHTML(fields[i].signatureAlgorithm)+':'+escapeHTML(fields[i].name)+''; }else{ - var html=''+fields[i].signatureAlgorithm+':'+fields[i].name+''; + var html=''+escapeHTML(fields[i].signatureAlgorithm)+':'+escapeHTML(fields[i].name)+''; } $("#his-proof-prof").append(html) } diff --git a/app/js/userdata/showOnTL.js b/app/js/userdata/showOnTL.js index 8c72c2e3..f7c40fdf 100644 --- a/app/js/userdata/showOnTL.js +++ b/app/js/userdata/showOnTL.js @@ -278,7 +278,7 @@ function misskeyUdg(user, acct_id) { $("#his-follow").text(json.followingCount); $("#his-follower").text(json.followersCount); $("#his-since").text(crat(json.createdAt)); - var note=json.description; + var note=escapeHTML(json.description); $("#his-des").html(twemoji.parse(note)); if(json.isCat){ $("#his-bot").html("Cat"+twemoji.parse("😺")); diff --git a/app/view/en/index.html b/app/view/en/index.html index d5e8dceb..63c4d40f 100644 --- a/app/view/en/index.html +++ b/app/view/en/index.html @@ -32,7 +32,7 @@