diff --git a/CHANGELOG.md b/CHANGELOG.md index 5cf9d22ba..2ae55cc7b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/). - Datasets downloaded with Clowder now include DataCite v4 XML files in the output /metadata folder for interoperability purposes. - Script to clean extractors' tmp files. - Script for RabbitMQ error queue cleanup. +- Ability to use basic html formatting in the welcome message on the home page. [#51](https://github.com/clowder-framework/clowder/issues/51) ### Changed - Improved simple test to report all day success. diff --git a/app/controllers/Application.scala b/app/controllers/Application.scala index 7433e186c..07bc5ddd0 100644 --- a/app/controllers/Application.scala +++ b/app/controllers/Application.scala @@ -1,17 +1,19 @@ package controllers import java.net.URL -import javax.inject.{Inject, Singleton} +import javax.inject.{Inject, Singleton} import api.Permission import api.Permission._ import play.api.{Logger, Play, Routes} import play.api.mvc.Action import services._ import models.{Event, UUID, User, UserStatus} +import org.owasp.html.Sanitizers import play.api.Logger import play.api.libs.concurrent.Execution.Implicits._ import play.api.Play.current +import util.Formatters.sanitizeHTML import scala.collection.immutable.List import scala.collection.mutable.ListBuffer @@ -212,9 +214,11 @@ class Application @Inject() (files: FileService, collections: CollectionService, val spacesCount = spaces.count() val usersCount = users.count() + val sanitezedWelcomeText = sanitizeHTML(AppConfiguration.getWelcomeMessage) + Ok(views.html.index(datasetsCount, filesCount, filesBytes, collectionsCount, spacesCount, usersCount, - AppConfiguration.getDisplayName, AppConfiguration.getWelcomeMessage)) + AppConfiguration.getDisplayName, sanitezedWelcomeText)) } } } @@ -233,8 +237,10 @@ class Application @Inject() (files: FileService, collections: CollectionService, val spacesCount = spaces.count() val usersCount = users.count() + val sanitezedWelcomeText = sanitizeHTML(AppConfiguration.getWelcomeMessage) + Ok(views.html.index(datasetsCount, filesCount, filesBytes, collectionsCount, - spacesCount, usersCount, AppConfiguration.getDisplayName, AppConfiguration.getWelcomeMessage)) + spacesCount, usersCount, AppConfiguration.getDisplayName, sanitezedWelcomeText)) } def email(subject: String, body: String) = UserAction(needActive=false) { implicit request => diff --git a/app/util/Formatters.scala b/app/util/Formatters.scala index 3d00ffa2b..9a3b2e4a9 100644 --- a/app/util/Formatters.scala +++ b/app/util/Formatters.scala @@ -3,6 +3,9 @@ package util import java.text.SimpleDateFormat import java.util.Date +import org.owasp.html.Sanitizers +import services.AppConfiguration + /** * Formatters */ @@ -77,4 +80,15 @@ object Formatters { val formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSX") formatter.parse(date) } + + /** + * Sanitize text to safely output to web frontend. For example remove any kind of javascript snippets. + * @param unsanitezedText user created text that has not been sanitized + * @return text that has been sanitized + */ + def sanitizeHTML(unsanitezedText: String): String = { + val policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS).and(Sanitizers.IMAGES).and(Sanitizers.BLOCKS). + and(Sanitizers.STYLES).and(Sanitizers.TABLES) + policy.sanitize(AppConfiguration.getWelcomeMessage) + } } diff --git a/app/views/index.scala.html b/app/views/index.scala.html index e3cf73845..d1abb0222 100644 --- a/app/views/index.scala.html +++ b/app/views/index.scala.html @@ -8,7 +8,7 @@
@welcomeMessage
+@Html(welcomeMessage)