Merge pull request #1676 from pateljannat/issues-127

fix: misc issues

frontend/src/components/CourseCard.vue

@@ -33,13 +33,13 @@
 					{{ tag }}
 				</div>
 			</div>
-			<div
+			<!-- <div
 				v-if="!course.image"
 				class="flex items-center justify-center text-white flex-1 font-extrabold text-2xl my-auto px-5 text-center leading-6"
 				:class="course.tags ? 'h-[80%]' : 'h-full'"
 			>
 				{{ course.title }}
-			</div>
+			</div> -->
 		</div>
 		<div class="flex flex-col flex-auto p-4">
 			<div class="flex items-center justify-between mb-2">
@@ -69,19 +69,12 @@
 						</span>
 					</Tooltip>
 				</div>
-
-				<!-- <div v-if="course.status != 'Approved'">
-					<Badge
-						variant="subtle"
-						:theme="course.status === 'Under Review' ? 'orange' : 'blue'"
-						size="sm"
-					>
-						{{ course.status }}
-					</Badge>
-				</div> -->
 			</div>
 
-			<div v-if="course.image" class="text-xl font-semibold leading-6">
+			<div
+				class="font-semibold leading-6"
+				:class="course.title.length > 32 ? 'text-lg' : 'text-xl'"
+			>
 				{{ course.title }}
 			</div>
 

frontend/src/utils/index.js

@@ -487,14 +487,39 @@ export function singularize(word) {
 	)
 }
 
-export const validateFile = (file, showToast = true) => {
+export const validateFile = async (file, showToast = true) => {
+	const error = (msg) => {
+		if (showToast) toast.error(msg)
+		console.error(msg)
+		return msg
+	}
+
 	if (!file.type.startsWith('image/')) {
-		const errorMessage = __('Only image file is allowed.')
-		if (showToast) {
-			toast.error(errorMessage)
+		return error(__('Only image file is allowed.'))
 	}
-		return errorMessage
+
+	if (file.type === 'image/svg+xml') {
+		const text = await file.text()
+
+		const blacklist = [
+			/<script[\s>]/i,
+			/on\w+=["']?/i,
+			/javascript:/i,
+			/data:/i,
+			/<iframe[\s>]/i,
+			/<object[\s>]/i,
+			/<embed[\s>]/i,
+			/<link[\s>]/i,
+		]
+
+		for (const pattern of blacklist) {
+			if (pattern.test(text)) {
+				return error(__('SVG contains potentially unsafe content.'))
 			}
+		}
+	}
+
+	return null
 }
 
 export const escapeHTML = (text) => {