From 9f8a5fb912cca56f131f9f4c7b199d24effa57d6 Mon Sep 17 00:00:00 2001
From: Tyler Burton <tyler.burton@gsa.gov>
Date: Mon, 17 Jun 2024 20:58:55 +0000
Subject: [PATCH] escapes meta tags & santitizes publisher url

---
 ckanext/datagovtheme/templates/package/read_base.html     | 2 +-
 ckanext/datagovtheme/templates/snippets/link_preview.html | 4 ++--
 setup.py                                                  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ckanext/datagovtheme/templates/package/read_base.html b/ckanext/datagovtheme/templates/package/read_base.html
index bffd28b5..40bfe163 100644
--- a/ckanext/datagovtheme/templates/package/read_base.html
+++ b/ckanext/datagovtheme/templates/package/read_base.html
@@ -116,7 +116,7 @@ <h2 class="module-heading"><img id="Publisher" src="/images/publisher.png" style
     {% endblock %}
     {% block publisher_content %}
     <p class="module-content">
-        <a href="/dataset?publisher={{ h.get_pkg_dict_extra(c.pkg_dict, 'publisher') }}" title="{{ _('publsher') }}">{{ h.get_pkg_dict_extra(c.pkg_dict, 'publisher') }}</a>
+        <a href="/dataset?publisher={{ h.sanitize_url(h.get_pkg_dict_extra(c.pkg_dict, 'publisher')) }}" title="{{ _('publisher') }}">{{ h.get_pkg_dict_extra(c.pkg_dict, 'publisher') }}</a>
     </p>
     {% endblock %}
 </section>
diff --git a/ckanext/datagovtheme/templates/snippets/link_preview.html b/ckanext/datagovtheme/templates/snippets/link_preview.html
index 5c579ff9..cb92b9c2 100644
--- a/ckanext/datagovtheme/templates/snippets/link_preview.html
+++ b/ckanext/datagovtheme/templates/snippets/link_preview.html
@@ -11,8 +11,8 @@
     <!-- Facebook Meta Tags -->
     <meta property="og:url" content="https://data.gov">
     <meta property="og:type" content="website">
-    <meta property="og:title" content="{{ organization }} - {{ dataset }}">
-    <meta property="og:description" content="{{ notes }}">
+    <meta property="og:title" content="{{ h.literal.escape(organization) }} - {{ h.literal.escape(dataset) }}">
+    <meta property="og:description" content="{{ h.literal.escape(notes) }}">
     <meta property="og:image" content="{{ img }}">
 
     <!-- Twitter Meta Tags -->
diff --git a/setup.py b/setup.py
index 9bd06e08..380249cd 100644
--- a/setup.py
+++ b/setup.py
@@ -10,7 +10,7 @@
 
 setup(
     name="ckanext-datagovtheme",
-    version="0.2.22",
+    version="0.2.23",
     description="CKAN Extension to manage data.gov theme",
     long_description=long_description,
     classifiers=[