Merge branch 'master' of github.com:noesya/osuny

app/models/communication/block.rb

@@ -50,6 +50,7 @@ class Communication::Block < ApplicationRecord
     key_figures: 56,
   }
 
+  before_validation :sanitize_data
   before_save :update_template_images
   after_commit :save_and_sync_about, on: [:update, :destroy]
 
@@ -77,11 +78,15 @@ class Communication::Block < ApplicationRecord
 
   protected
 
-  def save_and_sync_about
-    about&.save_and_sync unless about&.destroyed?
+  def sanitize_data
+    self.data = template.sanitized_data
   end
 
   def update_template_images
     self.template_images = template.active_storage_blobs
   end
+
+  def save_and_sync_about
+    about&.save_and_sync unless about&.destroyed?
+  end
 end

app/models/communication/block/template.rb

@@ -5,6 +5,10 @@ class Communication::Block::Template
     @block = block
   end
 
+  def sanitized_data
+    data
+  end
+
   def git_dependencies
     unless @git_dependencies
       @git_dependencies = []

app/models/communication/block/template/call_to_action.rb

 class Communication::Block::Template::CallToAction < Communication::Block::Template
+  def sanitized_data
+    {
+      "text" => Osuny::Sanitizer.sanitize(text),
+      "url" => url,
+      "button" => Osuny::Sanitizer.sanitize(button, 'string'),
+      "url_secondary" => url_secondary,
+      "button_secondary" => Osuny::Sanitizer.sanitize(button_secondary, 'string'),
+      "url_tertiary" => url_tertiary,
+      "button_tertiary" => Osuny::Sanitizer.sanitize(button_tertiary, 'string'),
+      "image" => data['image'],
+      "image_alt" => Osuny::Sanitizer.sanitize(data['image_alt'], 'string'),
+      "image_credit" => Osuny::Sanitizer.sanitize(data['image_credit'], 'string')
+    }
+  end
+
   def build_git_dependencies
     add_dependency image&.blob
   end

app/models/communication/block/template/chapter.rb

 class Communication::Block::Template::Chapter < Communication::Block::Template
+  def sanitized_data
+    {
+      "text" => Osuny::Sanitizer.sanitize(text),
+      "notes" => Osuny::Sanitizer.sanitize(notes),
+      "image" => data['image'],
+      "image_alt" => Osuny::Sanitizer.sanitize(data['image_alt'], 'string'),
+      "image_credit" => Osuny::Sanitizer.sanitize(data['image_credit'], 'string')
+    }
+  end
+
   def build_git_dependencies
     add_dependency image&.blob
   end

app/models/communication/block/template/image.rb

 class Communication::Block::Template::Image < Communication::Block::Template
+  def sanitized_data
+    {
+      "text" => Osuny::Sanitizer.sanitize(text),
+      "image" => data['image'],
+      "image_alt" => Osuny::Sanitizer.sanitize(data['image_alt'], 'string'),
+      "image_credit" => Osuny::Sanitizer.sanitize(data['image_credit'], 'string')
+    }
+  end
+
   def build_git_dependencies
     add_dependency image&.blob
   end

app/views/admin/communication/blocks/templates/chapter/_edit.html.erb

@@ -63,7 +63,7 @@
             for="image_credit">
       <%= t 'admin.communication.blocks.components.image.credit.label' %>
     </label>
-    <input id="image_alt"
+    <input id="image_credit"
             type="text"
             class="form-control"
             v-model="data.image_credit"

app/views/admin/communication/blocks/templates/embed/_edit.html.erb

@@ -9,7 +9,6 @@
               rows="10"
               class="form-control"
               v-model="data.code"
-              data-summernote-config="mini-list"
               placeholder="<%= t '.code_placeholder' %>"></textarea>
     </div>
   </div>