diff --git a/Gemfile b/Gemfile index 5b2f4f99a6a..3a1b16d5e2b 100644 --- a/Gemfile +++ b/Gemfile @@ -215,7 +215,11 @@ gem 'puma', require: false gem 'rbtrace', require: false, platform: :mri # required for feed importing and embedding -gem 'ruby-readability', require: false +# +# temporary when this is merged https://github.com/cantino/ruby-readability/pull/70 +# get rid of this +gem 'ruby-readability-discourse', require: false + gem 'simple-rss', require: false gem 'gctools', require: false, platform: :mri_21 gem 'stackprof', require: false, platform: :mri_21 diff --git a/Gemfile.lock b/Gemfile.lock index f1b81cd9b32..0dc855c39a4 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -298,7 +298,7 @@ GEM rspec-mocks (~> 2.14.0) ruby-hmac (0.4.0) ruby-openid (2.5.0) - ruby-readability (0.6.0) + ruby-readability-discourse (0.6.1) guess_html_encoding (>= 0.0.4) nokogiri (>= 1.4.2) sanitize (2.1.0) @@ -457,7 +457,7 @@ DEPENDENCIES rinku rspec-given rspec-rails - ruby-readability + ruby-readability-discourse sanitize sass sass-rails (~> 4.0.2) diff --git a/app/models/topic_embed.rb b/app/models/topic_embed.rb index c7c4cf290b8..0c9c918f6c5 100644 --- a/app/models/topic_embed.rb +++ b/app/models/topic_embed.rb @@ -64,10 +64,16 @@ class TopicEmbed < ActiveRecord::Base url = normalize_url(url) original_uri = URI.parse(url) - doc = Readability::Document.new(open(url).read, - tags: %w[div p code pre h1 h2 h3 b em i strong a img ul li ol blockquote], - attributes: %w[href src], - remove_empty_nodes: false) + opts = { + tags: %w[div p code pre h1 h2 h3 b em i strong a img ul li ol blockquote], + attributes: %w[href src], + remove_empty_nodes: false + } + + opts[:whitelist] = SiteSetting.embed_whitelist_selector if SiteSetting.embed_whitelist_selector.present? + opts[:blacklist] = SiteSetting.embed_blacklist_selector if SiteSetting.embed_blacklist_selector.present? + + doc = Readability::Document.new(open(url).read, opts) tags = {'img' => 'src', 'script' => 'src', 'a' => 'href'} title = doc.title diff --git a/config/locales/server.en.yml b/config/locales/server.en.yml index ac7c7c886c6..c53b1c01a39 100644 --- a/config/locales/server.en.yml +++ b/config/locales/server.en.yml @@ -870,6 +870,8 @@ en: embed_truncate: "Truncate the imported posts" embed_category: "Category of created topics" embed_post_limit: "Maximum number of posts to embed" + embed_whitelist_selector: "css selector for elements that are allowed in embeds" + embed_blacklist_selector: "css selector for elements that are removed from embeds" tos_accept_required: "If enabled, users will need to check a box on the signup form to confirm that they accept the terms of service. Edit 'Signup Form: Terms of Service Message' in the Content tab to change the message." notify_about_flags_after: "If there are flags that haven't been handled after this many hours, send an email to the contact_email. Set to 0 to disable." diff --git a/config/site_settings.yml b/config/site_settings.yml index 49c024f53d9..b12808c98d6 100644 --- a/config/site_settings.yml +++ b/config/site_settings.yml @@ -425,6 +425,8 @@ embedding: embed_category: '' embed_post_limit: 100 embed_truncate: false + embed_whitelist_selector: '' + embed_blacklist_selector: '' legal: tos_url: