jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-21 09:05:10 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[PublicDecks] Escape remote-crafted text in tooltips and the tab title

Browse source 
Deck names and usernames come from other users' records and Qt renders
QLabel tooltips as AutoText, so a name like '<h1><table>...' parsed as
markup. Escape and bound the deck-name tooltip and escape the username
interpolated into the title label.
This commit is contained in:
Lukas Brübach 2026-09-19 07:48:14 +02:00
parent 39178f91c8
commit f1a827e70f
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
cockatrice/src/interface/widgets/tabs/tab_public_decks.cpp
View file

@ -33,7 +33,7 @@ TabPublicDecks::TabPublicDecks(TabSupervisor *_tabSupervisor, AbstractClient *_c
model = new RemotePublicDecksModel(client, this);
cardSize = SettingsCache::instance().cardsDisplay().getVisualDeckStorageCardSize();
titleLabel = new QLabel(tr("Public decks of %1").arg(userName), this);
titleLabel = new QLabel(tr("Public decks of %1").arg(userName.toHtmlEscaped()), this);
QFont titleFont = titleLabel->font();
titleFont.setBold(true);
titleLabel->setFont(titleFont);
@ -116,7 +116,8 @@ QString TabPublicDecks::getTabText() const
void TabPublicDecks::retranslateUi()
{
titleLabel->setText(tr("Public decks of %1").arg(userName));
// The username is another user's data, so escape it for the AutoText QLabel.
titleLabel->setText(tr("Public decks of %1").arg(userName.toHtmlEscaped()));
emptyLabel->setText(tr("This user has not published any decks."));
refreshButton->setToolTip(tr("Refresh"));
quickSettingsWidget->setToolTip(tr("Public Decks Settings"));

5
cockatrice/src/interface/widgets/visual_deck_storage/deck_preview/public_deck_preview_widget.cpp
View file

@ -96,7 +96,10 @@ void PublicDeckPreviewWidget::setEntry(const RemotePublicDecksModel::DeckEntry &
// The deck name is the overlay text on the banner, like the local preview.
bannerCardDisplayWidget->setOverlayText(entry.name);
setToolTip(entry.name);
// The deck name comes from another user's record, and Qt tooltips are
// rendered as AutoText, so escape and bound it to keep it readable text
// (the overlay painted onto the banner is already a plain painter draw).
setToolTip(entry.name.left(200).toHtmlEscaped());
setBaseAccessibleName(entry.name);
tagsFlowWidget->clearLayout();