From cc020f24a2059ff5e3b67fa94720ced412d4d4e1 Mon Sep 17 00:00:00 2001 From: Martin Gross Date: Wed, 28 Feb 2024 21:21:52 +0100 Subject: [PATCH] Review Comments: Check for // instead of https for web-webfonts --- src/pretix/base/middleware.py | 2 +- src/pretix/base/pdf.py | 4 ++-- src/pretix/base/settings.py | 2 +- src/pretix/base/templatetags/startswith.py | 10 ---------- src/pretix/control/forms/event.py | 2 +- .../control/templates/pretixcontrol/pdf/webfonts.css | 7 +++---- src/pretix/control/views/pdf.py | 4 ++-- src/pretix/presale/style.py | 6 +++--- 8 files changed, 13 insertions(+), 24 deletions(-) delete mode 100644 src/pretix/base/templatetags/startswith.py diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py index bb68894dd..0fbe52494 100644 --- a/src/pretix/base/middleware.py +++ b/src/pretix/base/middleware.py @@ -270,7 +270,7 @@ class SecurityMiddleware(MiddlewareMixin): font_src = set() if hasattr(request, 'event'): - for font in get_fonts(request.event, pdf_only=False).values(): + for font in get_fonts(request.event, pdf_support_required=False).values(): for path in list(nested_dict_values(font)): font_location = urlparse(path) if font_location.scheme and font_location.netloc: diff --git a/src/pretix/base/pdf.py b/src/pretix/base/pdf.py index dbefef1e9..ef1c71797 100644 --- a/src/pretix/base/pdf.py +++ b/src/pretix/base/pdf.py @@ -748,7 +748,7 @@ class Renderer: pdfmetrics.registerFont(TTFont('Open Sans B', finders.find('fonts/OpenSans-Bold.ttf'))) pdfmetrics.registerFont(TTFont('Open Sans B I', finders.find('fonts/OpenSans-BoldItalic.ttf'))) - for family, styles in get_fonts(event, pdf_only=True).items(): + for family, styles in get_fonts(event, pdf_support_required=True).items(): pdfmetrics.registerFont(TTFont(family, finders.find(styles['regular']['truetype']))) if 'italic' in styles: pdfmetrics.registerFont(TTFont(family + ' I', finders.find(styles['italic']['truetype']))) @@ -941,7 +941,7 @@ class Renderer: # Since pdfmetrics.registerFont is global, we want to make sure that no one tries to sneak in a font, they # should not have access to. - if font not in list(get_fonts(order.event, pdf_only=True).keys()) + ['Open Sans']: + if font not in list(get_fonts(order.event, pdf_support_required=True).keys()) + ['Open Sans']: logger.warning(f'Unauthorized use of font "{font}"') font = 'Open Sans' diff --git a/src/pretix/base/settings.py b/src/pretix/base/settings.py index a58797d22..d15704411 100644 --- a/src/pretix/base/settings.py +++ b/src/pretix/base/settings.py @@ -89,7 +89,7 @@ def primary_font_kwargs(): choices = [('Open Sans', 'Open Sans')] choices += sorted([ - (a, {"title": a, "data": v}) for a, v in get_fonts(pdf_only=False).items() + (a, {"title": a, "data": v}) for a, v in get_fonts(pdf_support_required=False).items() ], key=lambda a: a[0]) return { 'choices': choices, diff --git a/src/pretix/base/templatetags/startswith.py b/src/pretix/base/templatetags/startswith.py deleted file mode 100644 index 561b7d5a1..000000000 --- a/src/pretix/base/templatetags/startswith.py +++ /dev/null @@ -1,10 +0,0 @@ -from django import template -from django.template.defaultfilters import stringfilter - -register = template.Library() - - -@register.filter('startswith') -@stringfilter -def startswith(text, start): - return text.startswith(start) diff --git a/src/pretix/control/forms/event.py b/src/pretix/control/forms/event.py index b111a7e7f..a7f11d839 100644 --- a/src/pretix/control/forms/event.py +++ b/src/pretix/control/forms/event.py @@ -653,7 +653,7 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett del self.fields['event_list_filters'] del self.fields['event_calendar_future_only'] self.fields['primary_font'].choices += [ - (a, {"title": a, "data": v}) for a, v in get_fonts(self.event, pdf_only=False).items() + (a, {"title": a, "data": v}) for a, v in get_fonts(self.event, pdf_support_required=False).items() ] # create "virtual" fields for better UX when editing _asked and _required fields diff --git a/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css b/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css index 44c11024a..4fd8c09c3 100644 --- a/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css +++ b/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css @@ -1,5 +1,4 @@ {% load static %} -{% load startswith %} @font-face { font-family: 'AND'; @@ -29,9 +28,9 @@ {% else %} font-weight: normal; {% endif %} - src: {% if "woff2" in formats %}{% if formats.woff2|startswith:'https' %}url('{{ formats.woff2 }}'){% else %}url('{% static formats.woff2 %}'){% endif %} format('woff2'),{% endif %} - {% if "woff" in formats %}{% if formats.woff|startswith:'https' %}url('{{ formats.woff }}'){% else %}url('{% static formats.woff %}'){% endif %} format('woff'),{% endif %} - {% if "truetype" in formats %}{% if formats.truetype|startswith:'https' %}url('{{ formats.truetype }}'){% else %}url('{% static formats.truetype %}'){% endif %} format('truetype'){% endif %}; + src: {% if "woff2" in formats %}{% if '//' in formats.woff2 %}url('{{ formats.woff2 }}'){% else %}url('{% static formats.woff2 %}'){% endif %} format('woff2'),{% endif %} + {% if "woff" in formats %}{% if '//' in formats.woff %}url('{{ formats.woff }}'){% else %}url('{% static formats.woff %}'){% endif %} format('woff'),{% endif %} + {% if "truetype" in formats %}{% if '//' in formats.truetype %}url('{{ formats.truetype }}'){% else %}url('{% static formats.truetype %}'){% endif %} format('truetype'){% endif %}; } .preload-font[data-family="{{family}}"][data-style="{{style}}"] { font-family: '{{ family }}', 'AND'; diff --git a/src/pretix/control/views/pdf.py b/src/pretix/control/views/pdf.py index 0093efddf..9407cb949 100644 --- a/src/pretix/control/views/pdf.py +++ b/src/pretix/control/views/pdf.py @@ -262,7 +262,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView): def get_context_data(self, **kwargs): ctx = super().get_context_data(**kwargs) - ctx['fonts'] = get_fonts(self.request.event, pdf_only=True) + ctx['fonts'] = get_fonts(self.request.event, pdf_support_required=True) ctx['pdf'] = self.get_current_background() ctx['variables'] = self.get_variables() ctx['images'] = self.get_images() @@ -278,7 +278,7 @@ class FontsCSSView(TemplateView): def get_context_data(self, **kwargs): ctx = super().get_context_data(**kwargs) - ctx['fonts'] = get_fonts(self.request.event if hasattr(self.request, 'event') else None) + ctx['fonts'] = get_fonts(self.request.event if hasattr(self.request, 'event') else None, pdf_support_required=True) return ctx diff --git a/src/pretix/presale/style.py b/src/pretix/presale/style.py index fab5503de..44189bd60 100644 --- a/src/pretix/presale/style.py +++ b/src/pretix/presale/style.py @@ -252,7 +252,7 @@ As with all plugin signals, the ``sender`` keyword argument will contain the eve """ -def get_fonts(event: Event = None, pdf_only=False): +def get_fonts(event: Event = None, pdf_support_required=False): def nested_dict_values(d): for v in d.values(): if isinstance(v, dict): @@ -272,8 +272,8 @@ def get_fonts(event: Event = None, pdf_only=False): received_fonts.update(value) for font, payload in received_fonts.items(): - if pdf_only: - if any(v.startswith('https') for v in list(nested_dict_values(payload))): + if pdf_support_required: + if any('//' in v for v in list(nested_dict_values(payload))): continue f.update({font: payload}) else: