punkweb-bb 0.5.0__py3-none-any.whl → 0.5.2__py3-none-any.whl

punkweb_bb/bbcode.py

@@ -1,5 +1,13 @@
 import bbcode
 
+from punkweb_bb.settings import ALLOWED_URL_SCHEMES
+
+def safe_url(href):
+    href = (href or "").strip()
+    if not href:
+        return None
+    lower = href.lower()
+    return href if any(lower.startswith(s + ":") for s in ALLOWED_URL_SCHEMES) else None
 
 def add_font_tag(parser):
     def _render_font(name, value, options, parent, context):
@@ -40,19 +48,23 @@ def add_shadow_tag(parser):
 
     parser.add_formatter("shadow", _render_shadow)
 
-
 def add_url_tag(parser):
     def _render_url(name, value, options, parent, context):
         if "url" in options:
-            url = options["url"]
+            url = safe_url(options["url"])
+            if url is None:
+                return value
             return f'<a href="{url}">{value}</a>'
-        return f'<a href="{value}">{value}</a>'
+
+        url = safe_url(value)
+        if url is None:
+            return value
+        return f'<a href="{url}">{value}</a>'
 
     parser.add_formatter(
         "url", _render_url, replace_links=False, replace_cosmetic=False
     )
 
-
 def add_quote_tag(parser):
     def _render_quote(name, value, options, parent, context):
         if "quote" in options:

punkweb_bb/migrations/0008_alter_groupstyle_username_style.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.11 on 2024-10-08 21:21
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('punkweb_bb', '0007_boardprofile_bio'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='groupstyle',
+            name='username_style',
+            field=models.TextField(help_text='BBCode style for the username.  Use {USER} as a placeholder for the username.  Example: [b]{USER}[/b]'),
+        ),
+    ]

punkweb_bb/models.py

@@ -195,9 +195,10 @@ class Post(UUIDPrimaryKeyMixin, TimestampMixin):
         return thread_url
 
     def save(self, *args, **kwargs):
-        if self.thread.is_closed:
-            raise ValidationError("Cannot add posts to a closed thread.")
         if self._state.adding:
+            if self.thread.is_closed:
+                raise ValidationError("Cannot add posts to a closed thread.")
+
             self.thread.last_post_created_at = timezone.now()
             self.thread.save()
         super().save(*args, **kwargs)
@@ -223,7 +224,9 @@ class GroupStyle(UUIDPrimaryKeyMixin, TimestampMixin):
         default=0,
         help_text="Highest priority is displayed",
     )
-    username_style = models.TextField()
+    username_style = models.TextField(
+        help_text="BBCode style for the username.  Use {USER} as a placeholder for the username.  Example: [b]{USER}[/b]"
+    )
 
     class Meta:
         ordering = ("-priority",)

punkweb_bb/settings.py

@@ -13,3 +13,5 @@ SHOUTBOX_POLLING_INTERVAL = PUNKWEB_BB.get("SHOUTBOX_POLLING_INTERVAL", 30)
 DISCORD_WIDGET_ENABLED = PUNKWEB_BB.get("DISCORD_WIDGET_ENABLED", False)
 DISCORD_WIDGET_THEME = PUNKWEB_BB.get("DISCORD_WIDGET_THEME", "dark")
 DISCORD_SERVER_ID = PUNKWEB_BB.get("DISCORD_SERVER_ID", None)
+# allow listing `javascript` will enable the weaponization of shoutbox bbcode.
+ALLOWED_URL_SCHEMES = PUNKWEB_BB.get("ALLOWED_URL_SCHEMES", ["http", "https"])

punkweb_bb/static/punkweb_bb/css/bbcode-editor-content.css

@@ -72,6 +72,10 @@ code {
   direction: ltr;
 }
 
+pre code {
+  font-size: 0.75rem;
+}
+
 blockquote {
   background: #f1f3f5;
   margin: 0.25rem 0;

punkweb_bb/static/punkweb_bb/css/members.css

@@ -42,3 +42,9 @@
 .members__user__stat__value {
   color: var(--oc-gray-9);
 }
+
+@media screen and (max-width: 768px) {
+  .members__header {
+    flex-direction: column;
+  }
+}

punkweb_bb/static/punkweb_bb/css/punkweb.css

@@ -154,3 +154,7 @@ hr {
   margin: 0;
   padding: 0;
 }
+
+pre[class*="language-"] {
+  font-size: 0.75rem;
+}

punkweb_bb/static/punkweb_bb/vendor/prism-duotone-sea.css

@@ -0,0 +1,170 @@
+code[class*='language-'],
+pre[class*='language-'] {
+  font-family: Consolas, Menlo, Monaco, 'Andale Mono WT', 'Andale Mono', 'Lucida Console', 'Lucida Sans Typewriter',
+    'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Liberation Mono', 'Nimbus Mono L', 'Courier New', Courier,
+    monospace;
+  font-size: 14px;
+  line-height: 1.375;
+  direction: ltr;
+  text-align: left;
+  white-space: pre;
+  word-spacing: normal;
+  word-break: normal;
+
+  -moz-tab-size: 4;
+  -o-tab-size: 4;
+  tab-size: 4;
+
+  -webkit-hyphens: none;
+  -moz-hyphens: none;
+  -ms-hyphens: none;
+  hyphens: none;
+  background: oklch(27.8% 0.033 256.848); /* gray 800 */
+  color: oklch(87.2% 0.01 258.338); /* gray 400 */
+}
+
+pre > code[class*='language-'] {
+  font-size: 1em;
+}
+
+pre[class*='language-']::-moz-selection,
+pre[class*='language-'] ::-moz-selection,
+code[class*='language-']::-moz-selection,
+code[class*='language-'] ::-moz-selection {
+  text-shadow: none;
+  background: oklch(50% 0.134 242.749); /* sky 700 */
+}
+
+pre[class*='language-']::selection,
+pre[class*='language-'] ::selection,
+code[class*='language-']::selection,
+code[class*='language-'] ::selection {
+  text-shadow: none;
+  background: oklch(50% 0.134 242.749); /* sky 700 */
+}
+
+/* Code blocks */
+pre[class*='language-'] {
+  padding: 1em;
+  margin: 0.5em 0;
+  overflow: auto;
+}
+
+/* Inline code */
+:not(pre) > code[class*='language-'] {
+  padding: 0.1em;
+  border-radius: 0.3em;
+}
+
+.token.comment,
+.token.prolog,
+.token.doctype,
+.token.cdata {
+  color: oklch(70.7% 0.022 261.325); /* gray 400 */
+}
+
+.token.punctuation {
+  color: oklch(70.7% 0.022 261.325); /* gray 400 */
+}
+
+.token.namespace {
+  opacity: 0.7;
+}
+
+.token.tag,
+.token.operator,
+.token.number {
+  color: oklch(69.6% 0.17 162.48); /* emerald 500 */
+}
+
+.token.property,
+.token.function {
+  color: oklch(87.2% 0.01 258.338); /* gray 400 */
+}
+
+.token.tag-id,
+.token.selector,
+.token.atrule-id {
+  color: oklch(95.1% 0.026 236.824); /* sky 100 */
+}
+
+code.language-javascript,
+.token.attr-name {
+  color: oklch(90.1% 0.058 230.902); /* sky 200 */
+}
+
+code.language-css,
+code.language-scss,
+.token.boolean,
+.token.string,
+.token.entity,
+.token.url,
+.language-css .token.string,
+.language-scss .token.string,
+.style .token.string,
+.token.attr-value,
+.token.keyword,
+.token.control,
+.token.directive,
+.token.unit,
+.token.statement,
+.token.regex,
+.token.atrule {
+  color: oklch(84.5% 0.143 164.978); /* emerald 300 */
+}
+
+.token.placeholder,
+.token.variable {
+  color: oklch(84.5% 0.143 164.978); /* emerald 300 */
+}
+
+.token.deleted {
+  text-decoration: line-through;
+}
+
+.token.inserted {
+  border-bottom: 1px dotted oklch(95.1% 0.026 236.824); /* sky 100 */
+  text-decoration: none;
+}
+
+.token.italic {
+  font-style: italic;
+}
+
+.token.important,
+.token.bold {
+  font-weight: bold;
+}
+
+.token.important {
+  color: oklch(74.6% 0.16 232.661); /* sky 400 */
+}
+
+.token.entity {
+  cursor: help;
+}
+
+pre > code.highlight {
+  outline: 0.4em solid oklch(58.8% 0.158 241.966); /* sky 600 */
+  outline-offset: 0.4em;
+}
+
+/* overrides color-values for the Line Numbers plugin
+ * http://prismjs.com/plugins/line-numbers/
+ */
+.line-numbers.line-numbers .line-numbers-rows {
+  border-right-color: oklch(44.6% 0.03 256.802); /* gray 600 */
+}
+
+.line-numbers .line-numbers-rows > span:before {
+  color: oklch(55.1% 0.027 264.364); /* gray 500 */
+}
+
+/* overrides color-values for the Line Highlight plugin
+* http://prismjs.com/plugins/line-highlight/
+*/
+.line-highlight.line-highlight {
+  background: rgba(10, 163, 112, 0.2);
+  background: -webkit-linear-gradient(left, rgba(10, 163, 112, 0.2) 70%, rgba(10, 163, 112, 0));
+  background: linear-gradient(to right, rgba(10, 163, 112, 0.2) 70%, rgba(10, 163, 112, 0));
+}