Changeset - 14abe07a4a8b
[Not reviewed]
0 10 0
Ben Sturmfels (bsturmfels) - 2 years ago 2021-12-17 10:55:47
ben@sturm.com.au
Remove unnecessary use of "safe" template tag.

This tag marks a variable as not requiring escaping by the template engine,
potentially creating cross-site scripting vulnerabilities, so shouldn't be used
unless absolutely necessary. In these cases, I don't think it's necessary.
10 files changed with 14 insertions and 14 deletions:
0 comments (0 inline, 0 general)
www/conservancy/templates/blog/entry_detail.html
Show inline comments
 
{% extends "base_blog.html" %}
 

	
 
{% block head %}
 
{% include "opengraph_partial.html" with url=object.get_absolute_url title=object.headline description=object.get_description %}
 
{% include "opengraph_urllist_partial.html" with property='image' urls=object.get_one_image_url fallback='/img/conservancy-logo.png' %}
 
{% include "opengraph_urllist_partial.html" with property='video' urls=object.get_one_video_url %}
 
{% endblock %}
 

	
 
{% block subtitle %}{{ object.headline|striptags|safe }} - Conservancy Blog - {% endblock %}
 
{% block subtitle %}{{ object.headline|striptags }} - Conservancy Blog - {% endblock %}
 

	
 
{% block content %}
 
<div class="breadcrumbs">
 
  <p><a href="/">Home</a> / <a href="/news/">News</a> / <a href="/blog/">Blog</a></p>
 
</div>
 

	
 
{% include "blog/entry_partial.html" with entry=object htag="h2" only %}
 

	
 
<p class="blog-comments">Please email any comments on this entry to
 
  <a href="mailto:info@sfconservancy.org">info@sfconservancy.org</a>.</p>
 

	
 
<p><span class="continued"><a href="/blog/">Other Conservancy Blog entries&hellip;</a></span></p>
 

	
 
{% endblock %}
www/conservancy/templates/blog/entry_partial.html
Show inline comments
 
{% comment %}
 

	
 
This partial requires these parameters:
 

	
 
* `entry`: The BlogEntry object to render.
 

	
 
This partial accepts these optional parameters:
 

	
 
* `show`: How much of the BlogEntry to render.  Accepted values are
 
  "headline", "dateline", "summary", "summary+tags", and "body".
 
  Every value will render the parts listed before it, except "body"
 
  doesn't include "summary".  Default "body".
 
* `htag`: Name of the HTML tag to render the entry headline.  Default "h3".
 

	
 
{% endcomment %}
 

	
 
<div class="blog-entry">
 

	
 
<{{ htag|default:"h3" }} class="clear"
 
  >{% if show|default:"body" != "body" %}<a href="{{ entry.get_absolute_url }}"
 
  >{% endif %}{{ entry.headline|safe }}{% if show|default:"body" != "body" %}</a>{% endif %}</{{ htag|default:"h3" }}>
 
  >{% endif %}{{ entry.headline }}{% if show|default:"body" != "body" %}</a>{% endif %}</{{ htag|default:"h3" }}>
 

	
 
{% if show != "headline" %}
 
<p class="date">by <span class="author">{{ entry.author.formal_name }}</span>
 
  on {{ entry.pub_date|date:"F j, Y" }}
 
</p>
 

	
 
{% if show != "dateline" %}
 

	
 
{% if show|default:"body" == "body" %}
 
{{ entry.body|safe }}
 
{% else %}
 
{{ entry.summary|safe }}
 
{% endif %}
 

	
 
{% if show|default:"body" != "body" %}
 
<p><a class="continued" href="{{ entry.get_absolute_url }}">Read More&hellip;</a></p>
 
{% endif %}
 
{% if show != "summary" %}
 
<p class="permalink"><a href="{{ entry.get_absolute_url }}">[permalink]</a></p>
 
{% endif %}
 

	
 
{% if show != "summary" and entry.tags.exists %}
 
<p class="blog-tags">Tags:
 
  {% for tag in entry.tags.iterator %}
 
  <a href="{{ tag.get_absolute_url }}">{{ tag.label }}</a>{% if not forloop.last %}, {% endif %}{% endfor %}</p>
 
{% endif %}
 

	
 
{% endif %}{# show != "dateline" #}
 
{% endif %}{# show != "headline" #}
 

	
 
</div>
www/conservancy/templates/feeds/blog_title.html
Show inline comments
 
{{ obj.headline|striptags|safe }}
 
{{ obj.headline|striptags }}
www/conservancy/templates/feeds/news_description.html
Show inline comments
 
{% if obj.subhead %}<p><strong>{{ obj.subhead|safe }}</strong></p>{% endif %}
 
{% if obj.subhead %}<p><strong>{{ obj.subhead }}</strong></p>{% endif %}
 
{{ obj.summary|safe }}
 
{{ obj.body|safe }}
www/conservancy/templates/feeds/news_title.html
Show inline comments
 
{{ obj.headline|striptags|safe }}
 
{{ obj.headline|striptags }}
www/conservancy/templates/frontpage.html
Show inline comments
...
 
@@ -59,64 +59,64 @@ strategies that defend FOSS (such as copyleft). <a href="/about" class="orange">
 
  {% if forloop.first or pressr.pub_date|date_within_past_days:365 %}
 
    {% if not forloop.first %}<hr class="clear">{% endif %}
 
    {% include "news/pressrelease_partial.html" with pressr=pressr show="dateline" only %}
 
  {% endif %}
 
{% endfor %}
 

	
 
<!-- <p><span class="continued"><a href="/news/">Conservancy News Archive&hellip;</a></span></p> -->
 
</section>
 

	
 
<section class="mt4 mb3 ph2">
 
<h2 class="f4 mb2 ttu"><!-- <a href="/feeds/blog/" class="feedlink"><img src="/img/feed-icon-14x14.png" alt="[RSS]"/></a> --> <a href="/blog/" class="dark-gray">Articles</a></h2>
 
{% for entry in blog|slice:":5" %}
 
  {% if forloop.first or entry.pub_date|date_within_past_days:180 %}
 
    {% if not forloop.first %}<hr class="clear">{% endif %}
 
    {% include "blog/entry_partial.html" with entry=entry show="dateline" only %}
 
  {% endif %}
 
{% endfor %}
 

	
 
<!-- <p><span class="continued"><a href="/blog/">Conservancy Blog Archive&hellip;</a></span></p> -->
 
</section>
 
</div>
 

	
 
<div class="w-30-ns mh2">
 
  <div class="ph3 pv2 ba b--gray">
 
    <h3 class="ttu">Term of the week</h3>
 
    <h4 class="f4 mt3 mb2 i navy">Complete Corresponding Source (CCS)</h4>
 
    <p>Informally, <acronym title="Complete Corresponding Source">CCS</acronym> is all of the technical materials and source code required to modify, run, and/or reinstall the software. The <acronym title="General Public License">GPL</acronym> and <acronym title="Lesser General Public License">LGPL</acronym> have a formal definitions for <acronym title="Complete Corresponding Source">CCS</acronym>, which is sometimes called "Corresponding Source."</p>
 
    <p><a href="/copyleft-compliance/glossary.html" class="orange ttu">Visit our glossary of terms</a></p>
 
  </div>
 

	
 
  <div class="mh3 pt3">
 
    <h2 class="f6 ttu mb1"><a href="https://lists.sfconservancy.org/mailman/listinfo/announce">Subscribe to our email list</a></h2>
 
    
 
    <br>
 

	
 
    <h2 class="f6 ttu mt2 mb1">RSS feed</h2>
 
    <div class="ml2">
 
      <a href="/feeds/omnibus" class="mr2"><svg class="orange" style="width: 30px; height: 30px;"><use href="{% static 'img/font_awesome.svg#rss-square' %}"></use></svg></a>
 
    </div>
 

	
 
    <h2 class="f6 ttu mt2 mb1">Follow us</h2>
 
    <div class="ml2">
 
      {% include 'socials_partial.html' %}
 
    </div>
 

	
 
<!-- <h2>Support Conservancy</h2>
 
     <p>As a 501(c)(3) non-profit charity, Conservancy relies on
 
     charitable donations for its operations.
 
     Please join {{supporters_count|safe}} others and <a href="/sustainer/"><strong>become a Conservancy Sustainer
 
     Please join {{ supporters_count }} others and <a href="/sustainer/"><strong>become a Conservancy Sustainer
 
     today</strong></a> and/or <a href="/donate/">donate generously</a> to help our work!
 
     </p>
 

	
 
     <h2>Learn More about Conservancy</h2>
 
     <p>
 
     <span class="continued"><a href="/about/">An Overview of Conservancy&hellip;</a></span>
 
     <span class="continued"><a href="/members/current/">Conservancy's current member projects&hellip;</a></span>
 
     <span class="continued"><a href="/members/services/">Services Conservancy provides to its member projects&hellip;</a></span>
 
     <span class="continued"><a href="/copyleft-compliance/">Conservancy's unique work  defending and upholding  copyleft licenses (e.g., the GPL) &hellip;</a></span>
 
     <span class="continued"><a href="/npoacct/">Conservancy's Non-Profit Accounting Project &hellip;</a></span>
 
     </p> -->
 
</div>
 
</div>
 
</div>
 
{% endblock %}
www/conservancy/templates/news/pressrelease_detail.html
Show inline comments
 
{% extends "base_news.html" %}
 

	
 
{% block head %}
 
{% include "opengraph_partial.html" with url=object.get_absolute_url title=object.headline description=object.get_description %}
 
{% include "opengraph_urllist_partial.html" with property='image' urls=object.get_one_image_url fallback='/img/conservancy-logo.png' %}
 
{% include "opengraph_urllist_partial.html" with property='video' urls=object.get_one_video_url %}
 
{% endblock %}
 

	
 
{% block subtitle %}{{ object.headline|striptags|safe }} - {% endblock %}
 
{% block subtitle %}{{ object.headline|striptags }} - {% endblock %}
 

	
 
{% block content %}
 

	
 
<div id="mainContent">
 
  <div class="breadcrumbs">
 
    <p><a href="/">Home</a> / <a href="/news/">News</a></p>
 
  </div>
 
{% include "news/pressrelease_partial.html" with pressr=object htag="h2" only %}
 
</div>
 
{% endblock %}
www/conservancy/templates/news/pressrelease_partial.html
Show inline comments
 
{% comment %}
 

	
 
This partial requires these parameters:
 

	
 
* `pressr`: The PressRelease object to render.
 

	
 
This partial accepts these optional parameters:
 

	
 
* `show`: How much of the PressRelease to render.  Accepted values are
 
  "headline", "dateline", "subhead", "summary", and "body".
 
  Every value will render the parts listed before it.  Default "body".
 
* `htag`: Name of the HTML tag to render the pressr headline.
 
  If you're passing show="subhead" or a greater detail level, this
 
  must be a headline tag h1 through h5, inclusive.  Default "h3".
 

	
 
{% endcomment %}
 

	
 
<div class="press-release">
 

	
 
<{{ htag|default:"h3" }} class="clear"
 
  >{% if show|default:"body" != "body" %}<a href="{{ pressr.get_absolute_url }}"
 
  >{% endif %}{{ pressr.headline|safe }}{% if show|default:"body" != "body" %}</a>{% endif %}</{{ htag|default:"h3" }}>
 
  >{% endif %}{{ pressr.headline }}{% if show|default:"body" != "body" %}</a>{% endif %}</{{ htag|default:"h3" }}>
 

	
 
{% if show != "headline" %}
 
{% if show != "dateline" and pressr.subhead %}
 
  {# This filter sequence generates the "next" hN tag from htag #}
 
  <h{{ htag|default:"3"|last|get_digit:1|add:1 }}
 
     >{{ pressr.subhead|safe }}</h{{ htag|default:"3"|last|get_digit:1|add:1 }}>
 
     >{{ pressr.subhead }}</h{{ htag|default:"3"|last|get_digit:1|add:1 }}>
 
{% endif %}
 

	
 
<p class="date">{{ pressr.pub_date|date:"F j, Y" }}</p>
 

	
 
{% if show != "dateline" and show != "subhead" %}
 
  {% if pressr.summary %}
 
    {{ pressr.summary|safe }}
 
  {% endif %}
 

	
 
  {% if pressr.body %}
 
    {% if show == "summary" %}
 
      <p><a class="continued" href="{{ pressr.get_absolute_url }}">Read More&hellip;</a></p>
 
    {% else %}
 
      {{ pressr.body|safe }}
 
    {% endif %}
 
  {% endif %}
 
{% endif %}
 

	
 
{% endif %}{# show != "headline" #}
 

	
 
</div>
www/conservancy/templates/opengraph_partial.html
Show inline comments
 
{% comment %}
 

	
 
Include this partial in a head section to include basic Open Graph metadata.
 
Pass a variable `NAME` to give a value for the `og:NAME` property.
 

	
 
These properties are only listed if you give a value for them:
 

	
 
* url: A URL string that includes at least an absolute path.  This partial
 
  will fill in a default scheme and host if needed.
 
* title: A string.  Tags are stripped, then the rest is assumed HTML-safe.
 
* description: A string.  Tags are stripped, then the rest is assumed
 
  HTML-safe.
 

	
 
These properties are always included.  You can override them but you
 
normally shouldn't need to:
 

	
 
* type: Default "website".
 
* locale: Default "en_US".
 
* site_name: Default "Software Freedom Conservancy"
 
* twitter_site: The name of the Twitter account that publishes this page.
 
  Default "@conservancy"
 

	
 
{% endcomment %}
 

	
 
{# This partial needs work before other cards besides "summary" are supported. #}
 
<meta property="twitter:card" content="summary">
 
<meta property="twitter:site" content="{{ twitter_site|default:"@conservancy" }}">
 

	
 
<meta property="og:type" content="{{ type|default:"website" }}">
 
<meta property="og:locale" content="{{ locale|default:"en_US" }}">
 
<meta property="og:site_name" content="{{ site_name|default:"Software Freedom Conservancy" }}">
 

	
 
{% if url %}
 
{% load fill_url %}
 
<meta property="og:url" content="{{ url|fill_url:host_url }}">
 
{% endif %}
 

	
 
{% if title %}
 
<meta property="og:title" content="{{ title|striptags|safe }}">
 
<meta property="og:title" content="{{ title|striptags }}">
 
{% endif %}
 

	
 
{% if description %}
 
<meta property="og:description" content="{{ description|striptags|safe }}">
 
<meta property="og:description" content="{{ description|striptags }}">
 
{% endif %}
www/conservancy/templates/sponsors.html
Show inline comments
...
 
@@ -7,62 +7,62 @@
 

	
 
{% block content %}
 
<div class="breadcrumbs">
 
  <p><a href="/">Home</a> / <a href="/about">Who We Are</a></p>
 
</div>
 

	
 
<h1>Conservancy's Sponsors &amp; Sustainers</h1>
 

	
 
<p>Conservancy relies on donations from the general public to support its
 
work, and asks everyone <a href="/donate">to donate generously</a>.
 

	
 
<h2>Sponsors</h2>
 

	
 
<p>The sponsors whose logos are listed below (in alphabetical order) have donated
 
substantially in the past twelve months to support the ongoing work of
 
Conservancy.  These sponsors support our work through financial
 
contributions  and have asked for public acknowledgment of their
 
contributions.  Conservancy graciously thanks these sponsors for their
 
support, but doesn't necessarily endorse nor promote any specific activity of
 
any of its sponsors.</p>
 

	
 
<!-- logos should be 250x250 maximum. -->
 
<ul id="sponsor">
 
<li><a rel="nofollow" href="https://www.ampr.org"><img src="/img/sponsors/ardc.svg" width="250" alt="Amateur Radio Digital Communications" /></a></li>
 
<li><a rel="nofollow" href="https://www.codeweavers.com/"><img src="/img/sponsors/codeweavers.png" width="250" alt="CodeWeavers" /></a></li>
 
<li><a rel="nofollow" href="https://google.com"><img src="/img/sponsors/google.png" height="76" width="238" alt="Google" /></a></li>
 
<li><a rel="nofollow" href="https://indeed.com"><img src="/img/sponsors/indeed.png" height="69" width="250" alt="Indeed" /></a></li>
 
<li><a rel="nofollow" href="https://jmp.chat"><img src="/img/sponsors/jmp.svg" height="244" width="250" alt="jmp.chat" /></a></li>
 
<li><a rel="nofollow" href="https://code.wildebeest.org/">Mark Wielaard</a></li>
 
<li><a rel="nofollow" href="https://www.mozilla.org/foundation/"><img src="/img/sponsors/mozilla.png" height="101" width="250" alt="Mozilla Foundation" /></a></li>
 
<li><a rel="nofollow" href="https://www.redhat.com/"><img src="/img/sponsors/redhat.png" height="80" width="250" alt="Red Hat" /></a></li>
 
</ul>
 

	
 
<!-- This section will be added when we have in-kind contributions -->
 

	
 
<!-- <h3>In-Kind Donation of Services</h3> -->
 

	
 
<!-- <p>Conservancy would also like to thank the following companies who have -->
 
<!--   donated services and/or resources in-kind to support Conservancy's -->
 
<!--   work.</p> -->
 

	
 
<!-- <ul> -->
 
<!-- </ul> -->
 
<br/>
 
<hr/>
 
<br/>
 
<h2>Sustainers</h2>
 

	
 
<p>Conservancy currently has {{supporters_count|safe}} Sustainers.
 
<p>Conservancy currently has {{ supporters_count }} Sustainers.
 
  Conservancy Sustainers are individuals (or small companies) who give $120
 
  or more annually as part of <a href="/sustainer/">the Official Conservancy
 
  Sustainer program</a>.  Those who request public acknowledgment are listed
 
  here in order by the date when they first joined the Sustainer program:</p>
 

	
 
<ul id="sustainers">
 
<li>Anonymous ({{anonymous_count|safe}} people)</li>
 
<li>Anonymous ({{ anonymous_count }} people)</li>
 
{% for ss in supporters %}
 
<li>{{ ss.display_name|safe }}</li>
 
<li>{{ ss.display_name }}</li>
 
{% endfor %}
 
</ul>
 

	
 
{% endblock %}
0 comments (0 inline, 0 general)