diff --git a/public-legacy/comments.php b/public-legacy/comments.php index e31ba1e..567c5f4 100644 --- a/public-legacy/comments.php +++ b/public-legacy/comments.php @@ -3,9 +3,7 @@ namespace Misuzu; use RuntimeException; -// basing whether or not this is an xhr request on whether a referrer header is present -// this page is never directy accessed, under normal circumstances -$redirect = !empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : url('index'); +$redirect = filter_input(INPUT_GET, 'return') ?? $_SERVER['HTTP_REFERER'] ?? url('index'); if(!is_local_url($redirect)) { echo render_info('Possible request forgery detected.', 403); diff --git a/src/url.php b/src/url.php index c7664df..08075fb 100644 --- a/src/url.php +++ b/src/url.php @@ -80,12 +80,12 @@ define('MSZ_URLS', [ 'settings-logs' => ['/settings/logs.php'], 'settings-data' => ['/settings/data.php'], - 'comment-create' => ['/comments.php', ['m' => 'create']], - 'comment-vote' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'vote', 'v' => '']], - 'comment-delete' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'delete']], - 'comment-restore' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'restore']], - 'comment-pin' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'pin']], - 'comment-unpin' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'unpin']], + 'comment-create' => ['/comments.php', ['m' => 'create', 'return' => '']], + 'comment-vote' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'vote', 'v' => '', 'return' => '']], + 'comment-delete' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'delete', 'return' => '']], + 'comment-restore' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'restore', 'return' => '']], + 'comment-pin' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'pin', 'return' => '']], + 'comment-unpin' => ['/comments.php', ['c' => '', 'csrf' => '{csrf}', 'm' => 'unpin', 'return' => '']], 'manage-index' => ['/manage'], diff --git a/templates/_layout/comments.twig b/templates/_layout/comments.twig index e940fae..85b662c 100644 --- a/templates/_layout/comments.twig +++ b/templates/_layout/comments.twig @@ -1,11 +1,11 @@ -{% macro comments_input(category, user, perms, reply_to) %} +{% macro comments_input(category, user, perms, reply_to, return_url) %} {% set reply_mode = reply_to is not null %} {% from 'macros.twig' import avatar %} {% from '_layout/input.twig' import input_hidden, input_csrf, input_checkbox %}
{{ input_hidden('comment[category]', category.id) }} {{ input_csrf() }} @@ -40,7 +40,7 @@
{% endmacro %} -{% macro comments_entry(comment, indent, category, user, colour, perms) %} +{% macro comments_entry(comment, indent, category, user, colour, perms, return_url) %} {% from 'macros.twig' import avatar %} {% from '_layout/input.twig' import input_checkbox_raw %} @@ -113,14 +113,14 @@ {% set dislike_vote_state = userVote < 0 ? 0 : -1 %} + href="{{ url('comment-vote', {'comment': comment.id, 'vote': like_vote_state, 'return': return_url}) }}"> Like {% if likes > 0 %} ({{ likes|number_format }}) {% endif %} + href="{{ url('comment-vote', {'comment': comment.id, 'vote':dislike_vote_state, 'return': return_url}) }}"> Dislike {% if dislikes > 0 %} ({{ dislikes|number_format }}) @@ -131,16 +131,16 @@ {% endif %} {% if perms.can_delete_any|default(false) or (poster.id|default(0) == user.id and perms.can_delete|default(false)) %} - Delete + Delete {% endif %} {# if user is not null %} Report {% endif #} {% if not isReply and perms.can_pin|default(false) %} - {{ comment.pinned ? 'Unpin' : 'Pin' }} + {{ comment.pinned ? 'Unpin' : 'Pin' }} {% endif %} {% elseif perms.can_delete_any|default(false) %} - Restore + Restore {% endif %} @@ -150,11 +150,11 @@ {% from _self import comments_entry, comments_input %} {% if user|default(null) is not null and category|default(null) is not null and perms.can_post|default(false) %} {{ input_checkbox_raw('', false, 'comment__reply-toggle', '', false, {'id':'comment-reply-toggle-' ~ comment.id}) }} - {{ comments_input(category, user, perms, comment) }} + {{ comments_input(category, user, perms, comment, return_url) }} {% endif %} {% if replies|length > 0 %} {% for reply in replies %} - {{ comments_entry(reply, indent + 1, category, user, colour, perms) }} + {{ comments_entry(reply, indent + 1, category, user, colour, perms, return_url) }} {% endfor %} {% endif %} @@ -162,7 +162,7 @@ {% endif %} {% endmacro %} -{% macro comments_section(category) %} +{% macro comments_section(category, return_url) %} {% set user = category.user %} {% set colour = category.colour %} {% set posts = category.posts %} @@ -189,7 +189,7 @@ {% else %} {% from _self import comments_input %} - {{ comments_input(category, user, perms) }} + {{ comments_input(category, user, perms, null, return_url) }} {% endif %} @@ -203,7 +203,7 @@ {% if posts|length > 0 %} {% from _self import comments_entry %} {% for comment in posts %} - {{ comments_entry(comment, 1, category, user, colour, perms) }} + {{ comments_entry(comment, 1, category, user, colour, perms, return_url) }} {% endfor %} {% else %}
diff --git a/templates/changelog/change.twig b/templates/changelog/change.twig index 2dbb173..27fe5ab 100644 --- a/templates/changelog/change.twig +++ b/templates/changelog/change.twig @@ -69,6 +69,6 @@
{{ container_title(' Comments for ' ~ change_info.date) }} - {{ comments_section(comments_info) }} + {{ comments_section(comments_info, canonical_url) }}
{% endblock %} diff --git a/templates/changelog/index.twig b/templates/changelog/index.twig index f625170..6b1e5d9 100644 --- a/templates/changelog/index.twig +++ b/templates/changelog/index.twig @@ -58,7 +58,7 @@ {% if is_date %}
{{ container_title(' Comments') }} - {{ comments_section(comments_info) }} + {{ comments_section(comments_info, canonical_url) }}
{% endif %} {% endblock %} diff --git a/templates/news/post.twig b/templates/news/post.twig index 32b9741..48734b3 100644 --- a/templates/news/post.twig +++ b/templates/news/post.twig @@ -13,7 +13,7 @@ {% if comments_info is defined %}
{{ container_title(' Comments') }} - {{ comments_section(comments_info) }} + {{ comments_section(comments_info, canonical_url) }}
{% endif %} {% endblock %}