Godfrey Chan 2ae913f45e
Consistently import escape from discourse-common (#23790)
`escape` from `pretty-text/sanitizer` is a re-export of the same
function defined in `discourse-common`. Updating the import paths
across the codebase to use the `discourse-common` import path.

`escape` is a rather simple function that can be accomplished with
a regular expression in `discourse-common`.

On the other hand, the remaining parts in `pretty-text/sanitizer`
has a lot of code, PLUS it depend on the rather heavy "xss" NPM
library.

Currently, most of the consumers of `pretty-text/sanitizer` are of
the `{ escape }` varient. This is resolved by this PR.

The remaining usages are either:

1. via/through `PrettyText` which is essentially gated behind
   loading the markdown-it bundle, OR

2. via `sanitize` from `discourse/lib/text`

I believe we may ultimately be able to move all the usages to behind
the markdown-it bundle (or, equivilantly, set up another lazy bundle
for `sanitize`) and be able to shed the sanitization code and the
"xss" library from the initial page load.

`discourse/lib/text` also defines a `sanitizeAsync` which is gated
behind loading the markdown-it bundle.

Looking through the usages of `sanitize`, I believe most of these
can be safely switched to use `sanitizeAsync`, in that they are
already in an asynchrnous path that handles a server response. Most
of them are actually rendering a piece of server-generated HTML
message as flash message, so I am not sure there really is value in
sanitizing (we should be able to trust our own server?), but in any
case, code-wise, they should already be able to absorb the async
just fine.

I am not sure if `sanitize` and `sanitizeAsync` are actually API
compatible – they both take `options` but I think those `options` do
pretty different things. This is somethign for another person to
investigate down the road in another PR.

According to `all-the-plugins`, `discourse-graphviz` also import
from this location, so perhaps we should PR to update. That being
said, it doesn't really hurt anything to keep the alias around for
a while.
2023-10-11 22:21:01 +01:00

73 lines
1.9 KiB
JavaScript

import Component from "@ember/component";
import { action } from "@ember/object";
import { and, gt } from "@ember/object/computed";
import { classNameBindings, classNames } from "@ember-decorators/component";
import escape from "discourse-common/lib/escape";
import { iconHTML } from "discourse-common/lib/icon-library";
import discourseComputed from "discourse-common/utils/decorators";
const MAX_COMPONENTS = 4;
@classNames("themes-list-item")
@classNameBindings("theme.selected:selected")
export default class ThemesListItem extends Component {
childrenExpanded = false;
@gt("children.length", 0) hasComponents;
@and("hasComponents", "theme.isActive") displayComponents;
@gt("theme.childThemes.length", MAX_COMPONENTS) displayHasMore;
click(e) {
if (!e.target.classList.contains("others-count")) {
this.navigateToTheme();
}
}
@discourseComputed(
"theme.component",
"theme.childThemes.@each.name",
"theme.childThemes.length",
"childrenExpanded"
)
children() {
const theme = this.theme;
let children = theme.get("childThemes");
if (theme.get("component") || !children) {
return [];
}
children = this.childrenExpanded
? children
: children.slice(0, MAX_COMPONENTS);
return children.map((t) => {
const name = escape(t.name);
return t.enabled ? name : `${iconHTML("ban")} ${name}`;
});
}
@discourseComputed("children")
childrenString(children) {
return children.join(", ");
}
@discourseComputed(
"theme.childThemes.length",
"theme.component",
"childrenExpanded",
"children.length"
)
moreCount(childrenCount, component, expanded) {
if (component || !childrenCount || expanded) {
return 0;
}
return childrenCount - MAX_COMPONENTS;
}
@action
toggleChildrenExpanded(event) {
event?.preventDefault();
this.toggleProperty("childrenExpanded");
}
}