diff --git a/resources/views/comments/comment.blade.php b/resources/views/comments/comment.blade.php
index eadf35187..d70a8c1d9 100644
--- a/resources/views/comments/comment.blade.php
+++ b/resources/views/comments/comment.blade.php
@@ -7,7 +7,6 @@
option:page-comment:updated-text="{{ trans('entities.comment_updated_success') }}"
option:page-comment:deleted-text="{{ trans('entities.comment_deleted_success') }}"
option:page-comment:archive-text="{{ $comment->archived ? trans('entities.comment_unarchive_success') : trans('entities.comment_archive_success') }}"
- option:page-comment:wysiwyg-language="{{ $locale->htmlLang() }}"
option:page-comment:wysiwyg-text-direction="{{ $locale->htmlDirection() }}"
id="comment{{$comment->local_id}}"
class="comment-box">
diff --git a/resources/views/comments/comments.blade.php b/resources/views/comments/comments.blade.php
index f27127e97..a5f0168a5 100644
--- a/resources/views/comments/comments.blade.php
+++ b/resources/views/comments/comments.blade.php
@@ -3,7 +3,6 @@
option:page-comments:created-text="{{ trans('entities.comment_created_success') }}"
option:page-comments:count-text="{{ trans('entities.comment_thread_count') }}"
option:page-comments:archived-count-text="{{ trans('entities.comment_archived_count') }}"
- option:page-comments:wysiwyg-language="{{ $locale->htmlLang() }}"
option:page-comments:wysiwyg-text-direction="{{ $locale->htmlDirection() }}"
class="comments-list tab-container"
aria-label="{{ trans('entities.comments') }}">
@@ -73,7 +72,6 @@
@if(userCan('comment-create-all') || $commentTree->canUpdateAny())
@push('body-end')
-
@include('form.editor-translations')
@include('entities.selector-popup')
@endpush
diff --git a/resources/views/form/description-html-input.blade.php b/resources/views/form/description-html-input.blade.php
index 3cf726ba4..52244eda6 100644
--- a/resources/views/form/description-html-input.blade.php
+++ b/resources/views/form/description-html-input.blade.php
@@ -1,5 +1,4 @@
diff --git a/resources/views/shelves/parts/form.blade.php b/resources/views/shelves/parts/form.blade.php
index 7790ba5a4..0207d7278 100644
--- a/resources/views/shelves/parts/form.blade.php
+++ b/resources/views/shelves/parts/form.blade.php
@@ -1,7 +1,3 @@
-@push('head')
-
-@endpush
-
{{ csrf_field() }}
diff --git a/tests/Entity/CommentDisplayTest.php b/tests/Entity/CommentDisplayTest.php
index 22e96c250..bffe29fa9 100644
--- a/tests/Entity/CommentDisplayTest.php
+++ b/tests/Entity/CommentDisplayTest.php
@@ -60,7 +60,6 @@ class CommentDisplayTest extends TestCase
$page = $this->entities->page();
$resp = $this->actingAs($editor)->get($page->getUrl());
- $resp->assertSee('tinymce.min.js?', false);
$resp->assertSee('window.editor_translations', false);
$resp->assertSee('component="entity-selector"', false);
@@ -68,7 +67,6 @@ class CommentDisplayTest extends TestCase
$this->permissions->grantUserRolePermissions($editor, ['comment-update-own']);
$resp = $this->actingAs($editor)->get($page->getUrl());
- $resp->assertDontSee('tinymce.min.js?', false);
$resp->assertDontSee('window.editor_translations', false);
$resp->assertDontSee('component="entity-selector"', false);
@@ -79,7 +77,6 @@ class CommentDisplayTest extends TestCase
]);
$resp = $this->actingAs($editor)->get($page->getUrl());
- $resp->assertSee('tinymce.min.js?', false);
$resp->assertSee('window.editor_translations', false);
$resp->assertSee('component="entity-selector"', false);
}
diff --git a/tests/Entity/CommentStoreTest.php b/tests/Entity/CommentStoreTest.php
index 8b8a5d488..c5fe4ce50 100644
--- a/tests/Entity/CommentStoreTest.php
+++ b/tests/Entity/CommentStoreTest.php
@@ -193,13 +193,14 @@ class CommentStoreTest extends TestCase
{
$page = $this->entities->page();
- $script = '
My lovely comment
';
+ $script = '
My lovely comment
';
$this->asAdmin()->postJson("/comment/$page->id", [
'html' => $script,
]);
$pageView = $this->get($page->getUrl());
$pageView->assertDontSee($script, false);
+ $pageView->assertDontSee('sneakyscript', false);
$pageView->assertSee('
My lovely comment
', false);
$comment = $page->comments()->first();
@@ -209,6 +210,7 @@ class CommentStoreTest extends TestCase
$pageView = $this->get($page->getUrl());
$pageView->assertDontSee($script, false);
+ $pageView->assertDontSee('sneakyscript', false);
$pageView->assertSee('
My lovely comment
updated
');
}
@@ -216,7 +218,7 @@ class CommentStoreTest extends TestCase
{
$page = $this->entities->page();
Comment::factory()->create([
- 'html' => '
scriptincommentest
',
+ 'html' => '
scriptincommentest
',
'entity_type' => 'page', 'entity_id' => $page
]);
@@ -229,7 +231,7 @@ class CommentStoreTest extends TestCase
public function test_comment_html_is_limited()
{
$page = $this->entities->page();
- $input = '
Test
Contenta
';
+ $input = '
Test
Contenta
';
$expected = '
Contenta
';
$resp = $this->asAdmin()->post("/comment/{$page->id}", ['html' => $input]);
@@ -248,4 +250,27 @@ class CommentStoreTest extends TestCase
'html' => $expected,
]);
}
+
+ public function test_comment_html_spans_are_cleaned()
+ {
+ $page = $this->entities->page();
+ $input = '
Hello do you have biscuits?
';
+ $expected = '
Hello do you have biscuits?
';
+
+ $resp = $this->asAdmin()->post("/comment/{$page->id}", ['html' => $input]);
+ $resp->assertOk();
+ $this->assertDatabaseHas('comments', [
+ 'entity_type' => 'page',
+ 'entity_id' => $page->id,
+ 'html' => $expected,
+ ]);
+
+ $comment = $page->comments()->first();
+ $resp = $this->put("/comment/{$comment->id}", ['html' => $input]);
+ $resp->assertOk();
+ $this->assertDatabaseHas('comments', [
+ 'id' => $comment->id,
+ 'html' => $expected,
+ ]);
+ }
}