[templates} Fix escaping HTML bugs in notes]

vrobbler/apps/scrobbles/dataclasses.py

@@ -51,26 +51,28 @@ class BaseLogData(JSONDataclass):
         return {}
 
     def notes_as_str(self, separator: str = " | ") -> str:
+        import html
         import re
 
         if not self.notes:
             return ""
 
         if isinstance(self.notes, str):
-            note_str = self.notes.encode("utf-8").decode("unicode_escape")
-            return re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", note_str)
+            return html.escape(re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", self.notes))
 
         if isinstance(self.notes, list):
             cleaned_notes = []
             for note in self.notes:
-                cleaned = note.encode("utf-8").decode("unicode_escape")
-                cleaned = re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", cleaned)
+                cleaned = html.escape(re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", note))
                 cleaned_notes.append(cleaned)
             return separator.join(cleaned_notes)
 
         return ""
 
     def notes_as_html(self) -> str:
+        import html
+        from django.utils.safestring import mark_safe
+
         if not self.notes:
             return ""
 
@@ -82,11 +84,11 @@ class BaseLogData(JSONDataclass):
 
         html_notes = []
         for note in notes_list:
-            escaped_note = note.encode("utf-8").decode("unicode_escape")
-            for line in escaped_note.split("\n"):
+            for line in note.split("\n"):
                 if line.strip():
-                    html_notes.append(f'<div class="sticky-note">{line}</div>')
-        return "".join(html_notes)
+                    escaped_line = html.escape(line)
+                    html_notes.append(f'<div class="sticky-note">{escaped_line}</div>')
+        return mark_safe("".join(html_notes))
 
 
 @dataclass

vrobbler/templates/foods/food_detail.html

@@ -35,7 +35,7 @@
                 <tr>
                         <td><a href={{scrobble.get_absolute_url}}>{{scrobble.local_timestamp}}</a></td>
                         <td>{% if scrobble.logdata.calories %}{{scrobble.logdata.calories}}{% else %}{{scrobble.media_obj.calories}}{% endif %}</td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                 </tr>
                 {% endfor %}
             </tbody>

vrobbler/templates/lifeevents/lifeevent_detail.html

@@ -37,7 +37,7 @@
                     <tr>
                         <td><a href="{{scrobble.get_absolute_url}}">{{scrobble.local_timestamp}}</a></td>
                         <td><a href="{{scrobble.get_media_source_url}}">{{scrobble.logdata.title}}</a></td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                         <td>{{scrobble.source}}</td>
                     </tr>
                     {% endfor %}

vrobbler/templates/locations/geolocation_detail.html

@@ -66,7 +66,7 @@
                     <tr>
                         <td><a href={{scrobble.get_absolute_url}}>{{scrobble.local_timestamp}}</a></td>
                         <td>{% for person in scrobble.logdata.with_people%}{{person}}{% if not forloop.last %}, {% endif%}{% endfor %}</td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                     </tr>
                     {% endfor %}
                 </tbody>

vrobbler/templates/tasks/task_detail.html

@@ -64,7 +64,7 @@
                     <tr>
                         <td><a href="{{scrobble.get_absolute_url}}">{{scrobble.local_timestamp}}</a></td>
                         <td><a href="{{scrobble.get_media_source_url}}">{{scrobble.logdata.title}}</a></td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                         <td>{{scrobble.source}}</td>
                     </tr>
                     {% endfor %}

vrobbler/templates/webpages/webpage_detail.html

@@ -190,7 +190,7 @@
                 {% for scrobble in scrobbles.all %}
                 <tr>
                     <td><a href={{scrobble.get_absolute_url}}>{{scrobble.local_timestamp}}</a></td>
-                    <td>{% if scrobble.logdata.notes %}{{ scrobble.logdata.notes_as_str|safe }}{% endif %}
+                    <td>{% if scrobble.logdata.notes %}{{ scrobble.logdata.notes_as_str }}{% endif %}
                 </tr>
                 {% endfor %}
             </tbody>