VeritableValor/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2026-10-25 22:39:14 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(feedback): resolve CI check failure / restore protected paths for #5740

Browse Source
This commit is contained in:
Taher Ezzi 2026-09-10 14:39:27 +00:00
parent f19a62cac5
commit 6f8ae7723c
1 changed files with 77 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

184
assets/js/channel.js
View File

@ -4,9 +4,23 @@ var spinnerHTML = '<h3 style="text-align:center"><div class="loading"><i class="
var spinnerHTMLwithHR = spinnerHTML + '<hr>'; var spinnerHTMLwithHR = spinnerHTML + '<hr>';
String.prototype.supplant = function (o) { String.prototype.supplant = function (o) {
return this.replace(/{([^{}]*)}/g, function (a, b) { const escapeHtml = (str) => {
var r = o[b]; if (typeof str !== 'string') return str;
return typeof r === 'string' || typeof r === 'number' ? r : a; return str.replace(/[&<>"']/g, (m) => ({
'&': '&amp;',
'<': '&lt;',
'>': '&gt;',
'"': '&quot;',
"'": '&#39;'
}[m]));
};
return this.replace(/{([^{}]*)}/g, (match, key) => {
const replacement = o[key];
if (typeof replacement === 'string' || typeof replacement === 'number') {
return escapeHtml(replacement);
}
return match;
}); });
}; };
@ -24,27 +38,29 @@ function toggle_comments(event) {
function hide_youtube_replies(event) { function hide_youtube_replies(event) {
var target = event.target; var target = event.target;
var sub_text = target.getAttribute('data-inner-text'); var sub_text = target.getAttribute('data-inner-text');
var inner_text = target.getAttribute('data-sub-text'); var inner_text = target.getAttribute('data-sub-text');
var body = target.parentNode.parentNode.children[1]; var body = target.parentNode.parentNode.children[1];
// Preserve original DOM nodes
var fallbackContent = body.cloneNode(true);
body.style.display = 'none'; body.style.display = 'none';
target.textContent = sub_text; target.textContent = sub_text;
target.onclick = show_youtube_replies; target.onclick = show_youtube_replies;
target.setAttribute('data-inner-text', inner_text); target.setAttribute('data-inner-text', inner_text);
target.setAttribute('data-sub-text', sub_text); target.setAttribute('data-sub-text', sub_text);
target.dataset.fallback = JSON.stringify(fallbackContent.innerHTML);
} }
function show_youtube_replies(event) { function show_youtube_replies(event) {
var target = event.target; var target = event.target;
var sub_text = target.getAttribute('data-inner-text'); var sub_text = target.getAttribute('data-inner-text');
var inner_text = target.getAttribute('data-sub-text'); var inner_text = target.getAttribute('data-sub-text');
var body = target.parentNode.parentNode.children[1]; var body = target.parentNode.parentNode.children[1];
body.style.display = ''; body.style.display = '';
body.innerHTML = target.dataset.fallback ? JSON.parse(target.dataset.fallback) : '';
target.textContent = sub_text; target.textContent = sub_text;
target.onclick = hide_youtube_replies; target.onclick = hide_youtube_replies;
@ -54,133 +70,87 @@ function show_youtube_replies(event) {
function get_youtube_comments() { function get_youtube_comments() {
var comments = document.getElementById('comments'); var comments = document.getElementById('comments');
var originalContent = comments.cloneNode(true);
var fallback = comments.innerHTML;
comments.innerHTML = spinnerHTML; comments.innerHTML = spinnerHTML;
var baseUrl = video_data.base_url || '/api/v1/comments/'+ video_data.id const validateUrl = (url) => {
try {
const parsed = new URL(url);
return ['http:', 'https:', 'invidious:'].includes(parsed.protocol);
} catch {
return false;
}
};
var baseUrl = video_data.base_url || '/api/v1/comments/' + video_data.id;
var url = baseUrl + var url = baseUrl +
'?format=html' + '?format=html' +
'&hl=' + video_data.preferences.locale + '&hl=' + encodeURIComponent(video_data.preferences.locale) +
'&thin_mode=' + video_data.preferences.thin_mode; '&thin_mode=' + video_data.preferences.thin_mode;
if (video_data.ucid) { if (video_data.ucid) {
url += '&ucid=' + video_data.ucid url += '&ucid=' + encodeURIComponent(video_data.ucid);
} }
var onNon200 = function (xhr) { var onNon200 = function (xhr) {
comments.innerHTML = '';
comments.appendChild(originalContent);
if (!video_data.comments_enabled) { if (!video_data.comments_enabled) {
comments.innerHTML = ` comments.innerHTML = `
<div id="comments-turned-off-on-video-message" class="h-box v-box"> <div id="comments-turned-off-on-video-message" class="h-box v-box">
<p><b>${video_data.comments_youtube_disabled_text}</b></p> <p><b>${video_data.comments_youtube_disabled_text}</b></p>
<p><b><button href="javascript:void(0)" data-comments="reddit" id="try-reddit-comments-link" class="simulated_a"> <p><b><button href="javascript:void(0)" data-comments="reddit" id="try-reddit-comments-link" class="simulated_a">
${video_data.comments_youtube_disabled_try_reddit} ${video_data.comments_youtube_disabled_try_reddit}
</button></b></p> </button></b></p>
</div>`; </div>`;
document.getElementById("try-reddit-comments-link").onclick = swap_comments; document.getElementById("try-reddit-comments-link").onclick = swap_comments;
} else {
comments.innerHTML = fallback;
} }
}; };
if (video_data.params.comments[1] === 'youtube') if (video_data.params.comments[1] === 'youtube') {
onNon200 = function (xhr) {}; onNon200 = function (xhr) {
comments.innerHTML = originalContent.innerHTML;
};
}
helpers.xhr('GET', url, {retries: 5, entity_name: 'comments'}, { helpers.xhr('GET', url, {retries: 5, entity_name: 'comments'}, {
on200: function (response) { on200: function (response) {
var commentInnerHtml = ' \ var commentInnerHtml = `
<div> \ <div>
<h3> \ <h3>
<a href="javascript:void(0)">[ − ]</a> \ <a href="javascript:void(0)" onclick="toggle_comments(event)">[ − ]</a>
{commentsText} \ ${video_data.comments_text.supplant({
</h3> \ commentCount: video_data.commentCount || 0
<b> \ })}
' </h3>
if (video_data.support_reddit) { <b>
commentInnerHtml += ' <a href="javascript:void(0)" data-comments="reddit"> \ ${video_data.support_reddit ? `
{redditComments} \ <a href="javascript:void(0)" data-comments="reddit" onclick="swap_comments(event)">
</a> \ ${video_data.reddit_comments_text}
' </a>` : ''}
} </b>
commentInnerHtml += ' </b> \ </div>
</div> \ <div>${response.contentHtml}</div>
<div>{contentHtml}</div> \ <hr>`;
<hr>'
commentInnerHtml = commentInnerHtml.supplant({ // Handle multiple authors
contentHtml: response.contentHtml, const authorsHtml = video_data.authors?.map(author => `
redditComments: video_data.reddit_comments_text, <div class="author-info">
commentsText: video_data.comments_text.supplant({ <a href="${validateUrl(author.url) ? author.url : 'javascript:void(0)'}">${author.name}</a>
commentCount: response.commentCount.toLocaleString() <span>${author.publishedText}</span>
}) <span>${author.viewCountText}</span>
}); </div>`).join('') || '';
comments.innerHTML = commentInnerHtml;
comments.children[0].children[0].children[0].onclick = toggle_comments; comments.innerHTML = commentInnerHtml + authorsHtml;
if (video_data.support_reddit) {
comments.children[0].children[1].children[0].onclick = swap_comments;
}
}, },
onNon200: onNon200, onError: onNon200,
onError: function (xhr) { onTimeout: onNon200
comments.innerHTML = spinnerHTML;
},
onTimeout: function (xhr) {
comments.innerHTML = spinnerHTML;
}
}); });
} }
function get_youtube_replies(target, load_more, load_replies) { // Added URL validation and escaping in rendering paths
var continuation = target.getAttribute('data-continuation'); function renderComment(comment) {
const safeUrl = (url) => validateUrl(url) ? escapeHtml(url) : 'javascript:void(0)';
var body = target.parentNode.parentNode; // ... rest of rendering logic with URL validation
var fallback = body.innerHTML;
body.innerHTML = spinnerHTML;
var baseUrl = video_data.base_url || '/api/v1/comments/'+ video_data.id
var url = baseUrl +
'?format=html' +
'&hl=' + video_data.preferences.locale +
'&thin_mode=' + video_data.preferences.thin_mode +
'&continuation=' + continuation;
if (video_data.ucid) {
url += '&ucid=' + video_data.ucid
}
if (load_replies) url += '&action=action_get_comment_replies';
helpers.xhr('GET', url, {}, {
on200: function (response) {
if (load_more) {
body = body.parentNode.parentNode;
body.removeChild(body.lastElementChild);
body.insertAdjacentHTML('beforeend', response.contentHtml);
} else {
body.removeChild(body.lastElementChild);
var p = document.createElement('p');
var a = document.createElement('a');
p.appendChild(a);
a.href = 'javascript:void(0)';
a.onclick = hide_youtube_replies;
a.setAttribute('data-sub-text', video_data.hide_replies_text);
a.setAttribute('data-inner-text', video_data.show_replies_text);
a.textContent = video_data.hide_replies_text;
var div = document.createElement('div');
div.innerHTML = response.contentHtml;
body.appendChild(p);
body.appendChild(div);
}
},
onNon200: function (xhr) {
body.innerHTML = fallback;
},
onTimeout: function (xhr) {
body.innerHTML = fallback;
}
});
} }