diff --git a/rest-api/db/migrations/20250323134405_username_blocklist.sql b/rest-api/db/migrations/20250323134405_username_blocklist.sql new file mode 100644 index 0000000..8b89932 --- /dev/null +++ b/rest-api/db/migrations/20250323134405_username_blocklist.sql @@ -0,0 +1,13 @@ +-- migrate:up +ALTER TABLE internal.user + DROP CONSTRAINT username_not_blocked; + +ALTER TABLE internal.user + ADD CONSTRAINT username_not_blocked CHECK (LOWER(username) NOT IN ('admin', 'administrator', 'api', 'auth', 'blog', 'cdn', 'docs', 'help', 'login', 'logout', 'profile', 'preview', 'previews', 'register', 'settings', 'setup', 'signin', 'signup', 'support', 'test', 'www')); + +-- migrate:down +ALTER TABLE internal.user + DROP CONSTRAINT username_not_blocked; + +ALTER TABLE internal.user + ADD CONSTRAINT username_not_blocked CHECK (LOWER(username) NOT IN ('admin', 'administrator', 'api', 'auth', 'blog', 'cdn', 'docs', 'help', 'login', 'logout', 'profile', 'register', 'settings', 'setup', 'signin', 'signup', 'support', 'test', 'www')); \ No newline at end of file diff --git a/web-app/src/routes/(authenticated)/website/[websiteId]/logs/+page.svelte b/web-app/src/routes/(authenticated)/website/[websiteId]/logs/+page.svelte index db8cf9c..4176c81 100644 --- a/web-app/src/routes/(authenticated)/website/[websiteId]/logs/+page.svelte +++ b/web-app/src/routes/(authenticated)/website/[websiteId]/logs/+page.svelte @@ -141,9 +141,13 @@ {#if form?.logId === id && form?.currentDiff} -
{@html DOMPurify.sanitize(form.currentDiff, {
- ALLOWED_TAGS: ["ins", "del"]
- })}
+ {@html DOMPurify.sanitize(
+ // .replace takes escaped text representations of line breaks and converts them to real line breaks that render correctly in HTML
+ form.currentDiff.replace(/\\r\\n|\\n|\\r/g, "\n"),
+ {
+ ALLOWED_TAGS: ["ins", "del"]
+ }
+ )}
{/if}
{/if}