jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-21 00:55:09 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[PublicDecks] Escape remote-crafted text in tooltips and the tab title

Browse source 
Deck names and usernames come from other users' records and Qt renders
QLabel tooltips as AutoText, so a name like '<h1><table>...' parsed as
markup. Escape and bound the deck-name tooltip and escape the username
interpolated into the title label.
This commit is contained in:
Lukas Brübach 2026-09-19 07:48:14 +02:00 • committed by GitHub
parent 454806d20e
commit 876e5e860e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
cockatrice/src/interface/widgets/tabs/tab_public_decks.cpp
View file

@ -33,7 +33,7 @@ TabPublicDecks::TabPublicDecks(TabSupervisor *_tabSupervisor, AbstractClient *_c
model = new RemotePublicDecksModel(client, this); model = new RemotePublicDecksModel(client, this);
cardSize = SettingsCache::instance().cardsDisplay().getVisualDeckStorageCardSize(); cardSize = SettingsCache::instance().cardsDisplay().getVisualDeckStorageCardSize();
titleLabel = new QLabel(tr("Public decks of %1").arg(userName), this); titleLabel = new QLabel(tr("Public decks of %1").arg(userName.toHtmlEscaped()), this);
QFont titleFont = titleLabel->font(); QFont titleFont = titleLabel->font();
titleFont.setBold(true); titleFont.setBold(true);
titleLabel->setFont(titleFont); titleLabel->setFont(titleFont);
@ -116,7 +116,8 @@ QString TabPublicDecks::getTabText() const
void TabPublicDecks::retranslateUi() void TabPublicDecks::retranslateUi()
{ {
titleLabel->setText(tr("Public decks of %1").arg(userName)); // The username is another user's data, so escape it for the AutoText QLabel.
titleLabel->setText(tr("Public decks of %1").arg(userName.toHtmlEscaped()));
emptyLabel->setText(tr("This user has not published any decks.")); emptyLabel->setText(tr("This user has not published any decks."));
refreshButton->setToolTip(tr("Refresh")); refreshButton->setToolTip(tr("Refresh"));
quickSettingsWidget->setToolTip(tr("Public Decks Settings")); quickSettingsWidget->setToolTip(tr("Public Decks Settings"));

5
cockatrice/src/interface/widgets/visual_deck_storage/deck_preview/public_deck_preview_widget.cpp
View file

@ -96,7 +96,10 @@ void PublicDeckPreviewWidget::setEntry(const RemotePublicDecksModel::DeckEntry &
// The deck name is the overlay text on the banner, like the local preview. // The deck name is the overlay text on the banner, like the local preview.
bannerCardDisplayWidget->setOverlayText(entry.name); bannerCardDisplayWidget->setOverlayText(entry.name);
setToolTip(entry.name); // The deck name comes from another user's record, and Qt tooltips are
// rendered as AutoText, so escape and bound it to keep it readable text
// (the overlay painted onto the banner is already a plain painter draw).
setToolTip(entry.name.left(200).toHtmlEscaped());
setBaseAccessibleName(entry.name); setBaseAccessibleName(entry.name);
tagsFlowWidget->clearLayout(); tagsFlowWidget->clearLayout();