diff --git a/internal/service/post_service.go b/internal/service/post_service.go index 13c6bb9..32cf005 100644 --- a/internal/service/post_service.go +++ b/internal/service/post_service.go @@ -53,8 +53,14 @@ func (s *PostService) auditEnabled() bool { return s.ss.IsAuditEnabled() } -// renderMarkdown 将 Markdown 渲染为安全 HTML(Goldmark + bluemonday 消毒) -func (s *PostService) renderMarkdown(body string) (string, error) { +// sanitizeHTML 对编辑器输出的 HTML 做安全消毒(bluemonday) +// 编辑器提交的是富文本 HTML,不再经过 Markdown 渲染 +func (s *PostService) sanitizeHTML(body string) string { + return ucgPolicy.Sanitize(body) +} + +// RenderMarkdown 对外暴露,用于预览(从纯文本 Markdown 渲染为 HTML) +func (s *PostService) RenderMarkdown(body string) (string, error) { var buf bytes.Buffer if err := s.md.Convert([]byte(body), &buf); err != nil { return "", err @@ -64,10 +70,7 @@ func (s *PostService) renderMarkdown(body string) (string, error) { // Create 创建帖子 func (s *PostService) Create(userID uint, title, body string) (*model.Post, error) { - bodyHTML, err := s.renderMarkdown(body) - if err != nil { - bodyHTML = body // 渲染失败降级使用纯文本 - } + bodyHTML := s.sanitizeHTML(body) status := model.PostStatusApproved if s.auditEnabled() { @@ -125,12 +128,7 @@ func (s *PostService) Update(postID uint, title, body string) error { post.Title = title post.Body = body - - bodyHTML, err := s.renderMarkdown(body) - if err != nil { - bodyHTML = body - } - post.BodyHTML = bodyHTML + post.BodyHTML = s.sanitizeHTML(body) // rejected 状态编辑后自动重置为 draft if post.Status == model.PostStatusRejected { @@ -214,8 +212,3 @@ func (s *PostService) Unlock(postID uint) error { func (s *PostService) Restore(postID uint) error { return s.repo.Restore(postID) } - -// RenderMarkdown 公开的 Markdown 渲染(供预览 API 使用,不写 DB) -func (s *PostService) RenderMarkdown(body string) (string, error) { - return s.renderMarkdown(body) -} diff --git a/templates/MetaLab-2026/html/posts/show.html b/templates/MetaLab-2026/html/posts/show.html index 885200a..5d537aa 100644 --- a/templates/MetaLab-2026/html/posts/show.html +++ b/templates/MetaLab-2026/html/posts/show.html @@ -8,7 +8,7 @@

{{.Post.Title}}

- + {{.Post.CreatedAt.Format "2006-01-02 15:04"}} {{if ne .Post.Status "approved"}} {{index $.StatusNames .Post.Status}} @@ -39,9 +39,6 @@ {{if and $.Post (eq $.Post.UserID $.UID) (or (eq $.Post.Status "draft") (eq $.Post.Status "rejected"))}} {{end}} - {{if $.CanAccessAdmin}} - 管理 - {{end}}
{{end}} @@ -51,6 +48,18 @@