jekyll-attendease 0.6.28 → 0.6.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a06e59fa86ba4ab646f4d67451d08f3027197eda
-  data.tar.gz: 5a583eb4b3d01c3cbe3553e80c45fa959b5fe6fc
+  metadata.gz: dd1caff91315f005bd0bfa4a0072eb1c81b284dd
+  data.tar.gz: 44ac7fa54a0a6f3e44efbda3ad2cefc7a593df37
 SHA512:
-  metadata.gz: e14bc84aba59e174ec9f7d80b05df98fb9cbd01d9bdf53d08a5d15d19e02494df11eef77d4189f258ca4d949a71831d898715e3b1fd25e7c9374596dbd180954
-  data.tar.gz: b5c2441d6e75954f77d1290f245051bb189eeff39333c26b1a63538308ab1771e704bbae3d90b209083ad29a70560dba4c570e8854c07b3670174768955effc6
+  metadata.gz: 7ba93e72a45301e19dc8b21da720cd5f0bfdc35b9ad14797e6c4226ee263dab15c22b11c63731474e7c4f9117d315fcde92b99e47d36be256ef29edb71dd30f1
+  data.tar.gz: 4d3efa46604b8c2b1770ab0ab3a8c3420b91bb88f0bc63de5b25a5fcb93ef0e7d6f839ea762b17012101ad121d2b3c31bbfe936f730e56ade12cac34068af47b

data/lib/jekyll/attendease_plugin/site_page_blocks_json.rb

@@ -0,0 +1,42 @@
+module Jekyll
+  module AttendeasePlugin
+    class SitePageBlocksJson < StaticFile
+      def initialize(site, base, page)
+        @site = site
+        @base = base
+        @dir = page['slug']
+        @name = 'index.json'
+
+        self.process(@name)
+
+        #require 'pry'
+        #binding.pry
+        #self.read_yaml(File.join(base, '_attendease', 'templates', 'pages'), 'default.html')
+        self.read_yaml(File.join(base, '_layouts'), "#{page['layout']}.html")
+
+        self.data['title'] = page['title']
+        self.data['layout'] = page['layout']
+
+        zones = {}
+
+        # create zone buckets
+        page['block_instances'].each do |i|
+          zones[i['zone']] = [] if zones[i['zone']].nil?
+          zones[i['zone']] << i
+        end
+
+        # sort each bucket by widget weight
+        zones.each do |k, zone|
+          zone.sort! { |x, y| x['weight'] <=> y['weight'] }
+          self.data[k] = ''
+          zone.each do |i|
+            self.data[k] << i['rendered_html']
+          end
+        end
+
+        self.data['site_page'] = page
+      end
+    end
+  end
+end
+

data/lib/jekyll/attendease_plugin/site_pages_generator.rb

@@ -6,6 +6,8 @@ module Jekyll
       def generate(site)
         site.data['pages'].each do |page|
           if !page['permanent'] && !page['external']
+            require 'cgi'
+            page['name'] = CGI.escapeHTML(page['name']) if page['name']
             site.pages << SitePage.new(site, site.source, page)
 
             zones = {}

data/lib/jekyll/attendease_plugin/version.rb

@@ -1,5 +1,5 @@
 module Jekyll
   module AttendeasePlugin
-    VERSION = '0.6.28'
+    VERSION = '0.6.29'
   end
 end

data/spec/lib/jekyll/attendease_plugin/site_pages_generator_spec.rb

@@ -6,6 +6,7 @@ RSpec.describe Jekyll::AttendeasePlugin::SitePagesGenerator do
   let(:index_file) { 'index.html' }
   let(:page) { site.data['pages'].detect { |p| p['slug'] == 'test' } }
   let(:external_page) { site.data['pages'].detect { |p| p['external'] == true } }
+  let(:xss_page) { site.data['pages'].detect { |p| p['slug'] == 'agenda' } }
 
   context 'regular page' do
     it 'creates a page using the provided slug' do
@@ -24,6 +25,17 @@ RSpec.describe Jekyll::AttendeasePlugin::SitePagesGenerator do
     end
   end
 
+  context 'page with XSS' do
+    it 'escapes HTML in the page title' do
+      slug = xss_page['slug']
+      file = File.join(site.config['destination'], slug, 'index.html')
+      expect(File.exists?(file)).to eq(true)
+      expect(File.file?(file)).to eq(true)
+      expect(File.read(file)).to include '<title>Agenda &lt;script&gt;alert()&lt;/script&gt;</title>'
+    end
+
+  end
+
   context 'external page' do
     it 'does not create a page using the provided slug' do
 

data/spec/spec_helper.rb

@@ -15,7 +15,7 @@ RSpec.configure do |config|
 
   config.before(:all) do
     if Gem::Version.new('2') <= Gem::Version.new(Jekyll::VERSION)
-      Jekyll.logger.log_level = :warn
+      Jekyll.logger.log_level = ENV['debug'].nil? ? :warn : :debug
     else
       Jekyll.logger.log_level = Jekyll::Stevenson::WARN
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-attendease
 version: !ruby/object:Gem::Version
-  version: 0.6.28
+  version: 0.6.29
 platform: ruby
 authors:
 - Michael Wood
@@ -183,6 +183,7 @@ files:
 - lib/jekyll/attendease_plugin/schedule_session_page.rb
 - lib/jekyll/attendease_plugin/schedule_sessions_page.rb
 - lib/jekyll/attendease_plugin/site_page.rb
+- lib/jekyll/attendease_plugin/site_page_blocks_json.rb
 - lib/jekyll/attendease_plugin/site_pages_generator.rb
 - lib/jekyll/attendease_plugin/sponsor_generator.rb
 - lib/jekyll/attendease_plugin/sponsors_index_page.rb