fds

files/assets/js/lite-youtube.js

@@ -52,6 +52,7 @@
 		const iframeEl = document.createElement('iframe');
 		iframeEl.width = 560;
 		iframeEl.height = 315;
+		iframeEl.sandbox = 'allow-scripts allow-same-origin';
 		iframeEl.title = this.playLabel;
 		iframeEl.allow = 'accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture';
 		iframeEl.allowFullscreen = true;

files/routes/login.py

@@ -248,7 +248,11 @@ def sign_up_post(v):
 
 	now = int(time.time())
 
-	username = request.values.get("username").strip()
+	username = request.values.get("username")
+	
+	if not username: abort(400)
+
+	username = username.strip()
 
 	def signup_error(error):
 

files/routes/posts.py

@@ -370,6 +370,9 @@ def viewmore(v, pid, sort, offset):
 @limiter.limit("1/second;30/minute;200/hour;1000/day")
 @auth_desired
 def morecomments(v, cid):
+	try: cid = int(cid)
+	except: abort(400)
+
 	tcid = g.db.query(Comment.top_comment_id).filter_by(id=cid).one_or_none()[0]
 
 	if v:

files/routes/users.py

@@ -859,7 +859,8 @@ def u_username(username, v=None):
 
 	sort = request.values.get("sort", "new")
 	t = request.values.get("t", "all")
-	page = int(request.values.get("page", "1"))
+	try: page = int(request.values.get("page", "1"))
+	except: abort(400)
 	page = max(page, 1)
 
 	ids = u.userpagelisting(v=v, page=page, sort=sort, t=t)