ui: html problem display

packages/ui-default/backendlib/template.js

@@ -9,6 +9,7 @@ const argv = require('cac')().parse();
 const { findFileSync } = require('@hydrooj/utils/lib/utils');
 const status = require('@hydrooj/utils/lib/status');
 const markdown = require('./markdown');
+const { xss } = require('./markdown-it-xss');
 
 const { misc, buildContent, avatar } = global.Hydro.lib;
 
@@ -86,7 +87,7 @@ class Nunjucks extends nunjucks.Environment {
         else s = s[langs[0]];
       }
       if (s instanceof Array) s = buildContent(s, html ? 'html' : 'markdown', (str) => str.translate(language));
-      return markdown.render(s);
+      return html ? xss.process(s) : markdown.render(s);
     });
     this.addFilter('log', (self) => {
       console.log(self);

packages/ui-default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.26.4",
+  "version": "4.26.5",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",

packages/ui-default/pages/problem_edit.page.js

@@ -123,7 +123,7 @@ function buildCategoryFilter() {
       // de-select children
       _.forEach(treeItem.children, (treeSubItem, subcategory) => {
         if (treeSubItem.select) {
-          treeSubItem.select = false; // eslint-disable-line no-param-reassign
+          treeSubItem.select = false;
           dirtyCategories.push({ type: 'subcategory', subcategory, category });
         }
       });

packages/ui-default/pages/problem_main.page.js

@@ -123,7 +123,7 @@ function buildCategoryFilter() {
       // de-select children
       _.forEach(treeItem.children, (treeSubItem, subcategory) => {
         if (treeSubItem.select) {
-          treeSubItem.select = false; // eslint-disable-line no-param-reassign
+          treeSubItem.select = false;
           dirtyCategories.push({ type: 'subcategory', subcategory, category });
         }
       });

packages/ui-default/templates/problem_main.html

@@ -24,8 +24,8 @@
         </div>
       </div>
     </div>
-    {% if handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
     <div class="medium-3 columns">
+      {% if handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
         <div class="section side nojs--hide">
           <ol class="menu">
             <a href="javascript:;" class="menu__link edit-mode-hide" name="enter-edit-mode">