szabodanika / microbin

A secure, configurable file-sharing and URL shortening web app written in Rust.
https://microbin.eu
BSD 3-Clause "New" or "Revised" License
2.65k stars 163 forks source link

How do I add a hyperlink to the text in the footer? #110

Closed RalstonLiu closed 1 year ago

RalstonLiu commented 1 year ago

I used docker to build microbin, and added "--footer-text" to the yaml file. I tried to use markdown syntax and html syntax, but microbin can't recognize the hyperlink. It's best if it opens in a new window, thanks!

szabodanika commented 1 year ago

Have you tried using html for this? Like <a href="https://newpage.com" target="_blank">Click Here</a>

RalstonLiu commented 1 year ago

Yes, I tried that and it still didn't work as expected :(

This is part of my docker-compose.yml file

This is what it looks like at the end

albocc commented 1 year ago

Microbin uses Askama for templating. From their documentation:

Askama by default escapes variables if it thinks it is rendering HTML content. It infers the escaping context from the extension of template filenames, escaping by default if the extension is one of html, htm, or xml. When specifying a template as source in an attribute, the ext attribute parameter must be used to specify a type. Additionally, you can specify an escape mode explicitly for your template by setting the escape attribute parameter value (to none or html).

Askama escapes <, >, &, ", and ', according to the OWASP escaping recommendations. Use the safe filter to prevent escaping for a single expression, or the escape (or e) filter to escape a single expression in an unescaped context.

The text you provided is not rendered as HTML due to this escaping. The solution would be to adjust the code in the footer.html template to trust the string like this:

<p style="font-size: smaller">
    {% if args.footer_text.as_ref().is_none() %}
    <a href="https://microbin.eu">MicroBin</a> by Dániel Szabó and the FOSS Community.
    Let's keep the Web <b>compact</b>, <b>accessible</b> and <b>humane</b>!
    {%- else %}
    {{ args.footer_text.as_ref().unwrap() | safe }}
    {%- endif %}
</p>