Merge branch 'iv-org:master' into verified-badge

src/invidious/views/components/item.ecr

@@ -54,7 +54,7 @@
                         <img loading="lazy" class="thumbnail" src="/vi/<%= item.id %>/mqdefault.jpg"/>
                         <% if plid = env.get?("remove_playlist_items") %>
                             <form data-onsubmit="return_false" action="/playlist_ajax?action_remove_video=1&set_video_id=<%= item.index %>&playlist_id=<%= plid %>&referer=<%= env.get("current_page") %>" method="post">
-                                <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                                <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                                 <p class="watched">
                                     <a data-onclick="remove_playlist_item" data-index="<%= item.index %>" data-plid="<%= plid %>" href="javascript:void(0)">
                                         <button type="submit" style="all:unset">
@@ -106,7 +106,7 @@
                         <img loading="lazy" class="thumbnail" src="/vi/<%= item.id %>/mqdefault.jpg"/>
                         <% if env.get? "show_watched" %>
                             <form data-onsubmit="return_false" action="/watch_ajax?action_mark_watched=1&id=<%= item.id %>&referer=<%= env.get("current_page") %>" method="post">
-                                <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                                <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                                 <p class="watched">
                                     <a data-onclick="mark_watched" data-id="<%= item.id %>" href="javascript:void(0)">
                                         <button type="submit" style="all:unset">
@@ -119,7 +119,7 @@
                             </form>
                         <% elsif plid = env.get? "add_playlist_items" %>
                             <form data-onsubmit="return_false" action="/playlist_ajax?action_add_video=1&video_id=<%= item.id %>&playlist_id=<%= plid %>&referer=<%= env.get("current_page") %>" method="post">
-                                <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                                <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                                 <p class="watched">
                                     <a data-onclick="add_playlist_item" data-id="<%= item.id %>" data-plid="<%= plid %>" href="javascript:void(0)">
                                         <button type="submit" style="all:unset">

src/invidious/views/components/subscribe_widget.ecr

@@ -2,7 +2,7 @@
     <% if subscriptions.includes? ucid %>
         <p>
             <form action="/subscription_ajax?action_remove_subscriptions=1&c=<%= ucid %>&referer=<%= env.get("current_page") %>" method="post">
-                <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                 <button data-type="unsubscribe" id="subscribe" class="pure-button pure-button-primary">
                     <b><input style="all:unset" type="submit" value="<%= translate(locale, "Unsubscribe") %> | <%= sub_count_text %>"></b>
                 </button>
@@ -11,7 +11,7 @@
     <% else %>
         <p>
             <form action="/subscription_ajax?action_create_subscription_to_channel=1&c=<%= ucid %>&referer=<%= env.get("current_page") %>" method="post">
-                <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                 <button data-type="subscribe" id="subscribe" class="pure-button pure-button-primary">
                     <b><input style="all:unset" type="submit" value="<%= translate(locale, "Subscribe") %> | <%= sub_count_text %>"></b>
                 </button>

src/invidious/views/create_playlist.ecr

@@ -30,7 +30,7 @@
                         </button>
                     </div>
 
-                    <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+                    <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
                 </fieldset>
             </form>
         </div>

src/invidious/views/delete_playlist.ecr

@@ -19,6 +19,6 @@
             </div>
         </div>
 
-        <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+        <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
     </form>
 </div>

src/invidious/views/edit_playlist.ecr

@@ -41,7 +41,7 @@
     <div class="h-box">
         <textarea maxlength="5000" name="description" style="margin-top:10px;max-width:100%;height:20vh" class="pure-input-1"><%= playlist.description %></textarea>
     </div>
-    <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+    <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
 </form>
 
 <% if playlist.is_a?(InvidiousPlaylist) && playlist.author == user.try &.email %>

src/invidious/views/embed.ecr

@@ -7,7 +7,7 @@
     <meta name="thumbnail" content="<%= thumbnail %>">
     <%= rendered "components/player_sources" %>
     <link rel="stylesheet" href="/videojs/videojs-overlay/videojs-overlay.css?v=<%= ASSET_COMMIT %>">
-    <script src="videojs/videojs-overlay/videojs-overlay.js?v=<%= ASSET_COMMIT %>"></script>
+    <script src="/videojs/videojs-overlay/videojs-overlay.js?v=<%= ASSET_COMMIT %>"></script>
     <link rel="stylesheet" href="/css/default.css?v=<%= ASSET_COMMIT %>">
     <link rel="stylesheet" href="/css/embed.css?v=<%= ASSET_COMMIT %>">
     <title><%= HTML.escape(video.title) %> - Invidious</title>

src/invidious/views/template.ecr

@@ -52,7 +52,7 @@
                         </div>
                         <div class="pure-u-1-4">
                             <a id="notification_ticker" title="<%= translate(locale, "Subscriptions") %>" href="/feed/subscriptions" class="pure-menu-heading">
-                                <% notification_count = env.get("user").as(User).notifications.size %>
+                                <% notification_count = env.get("user").as(Invidious::User).notifications.size %>
                                 <% if notification_count > 0 %>
                                     <span id="notification_count"><%= notification_count %></span> <i class="icon ion-ios-notifications"></i>
                                 <% else %>
@@ -67,12 +67,12 @@
                         </div>
                         <% if env.get("preferences").as(Preferences).show_nick %>
                             <div class="pure-u-1-4">
-                                <span id="user_name"><%= env.get("user").as(User).email %></span>
+                                <span id="user_name"><%= env.get("user").as(Invidious::User).email %></span>
                             </div>
                         <% end %>
                         <div class="pure-u-1-4">
                             <form action="/signout?referer=<%= env.get?("current_page") %>" method="post">
-                                <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                                <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                                 <a class="pure-menu-heading" href="#">
                                     <input style="all:unset" type="submit" value="<%= translate(locale, "Log out") %>">
                                 </a>

src/invidious/views/user/authorize_token.ecr

@@ -72,7 +72,7 @@
                 <input type="hidden" name="expire" value="<%= expire %>">
             <% end %>
 
-            <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+            <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
         </form>
     </div>
 <% end %>

src/invidious/views/user/change_password.ecr

@@ -23,7 +23,7 @@
                         <%= translate(locale, "Change password") %>
                     </button>
 
-                    <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+                    <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
                 </fieldset>
             </form>
         </div>

src/invidious/views/user/clear_watch_history.ecr

@@ -19,6 +19,6 @@
             </div>
         </div>
 
-        <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+        <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
     </form>
 </div>

src/invidious/views/user/delete_account.ecr

@@ -19,6 +19,6 @@
             </div>
         </div>
 
-        <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+        <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
     </form>
 </div>

src/invidious/views/user/login.ecr

@@ -66,7 +66,7 @@
                                 <% captcha = captcha.not_nil! %>
                                 <img style="width:50%" src='<%= captcha[:question] %>'/>
                                 <% captcha[:tokens].each_with_index do |token, i| %>
-                                    <input type="hidden" name="token[<%= i %>]" value="<%= URI.encode_www_form(token) %>">
+                                    <input type="hidden" name="token[<%= i %>]" value="<%= HTML.escape(token) %>">
                                 <% end %>
                                 <input type="hidden" name="captcha_type" value="image">
                                 <label for="answer"><%= translate(locale, "Time (h:mm:ss):") %></label>
@@ -74,7 +74,7 @@
                             <% else # "text" %>
                                 <% captcha = captcha.not_nil! %>
                                 <% captcha[:tokens].each_with_index do |token, i| %>
-                                    <input type="hidden" name="token[<%= i %>]" value="<%= URI.encode_www_form(token) %>">
+                                    <input type="hidden" name="token[<%= i %>]" value="<%= HTML.escape(token) %>">
                                 <% end %>
                                 <input type="hidden" name="captcha_type" value="text">
                                 <label for="answer"><%= captcha[:question] %></label>

src/invidious/views/user/preferences.ecr

@@ -206,6 +206,11 @@
             <% if env.get? "user" %>
                 <legend><%= translate(locale, "preferences_category_subscription") %></legend>
 
+                <div class="pure-control-group">
+                    <label for="watch_history"><%= translate(locale, "preferences_watch_history_label") %></label>
+                    <input name="watch_history" id="watch_history" type="checkbox" <% if preferences.watch_history %>checked<% end %>>
+                </div>
+
                 <div class="pure-control-group">
                     <label for="annotations_subscribed"><%= translate(locale, "preferences_annotations_subscribed_label") %></label>
                     <input name="annotations_subscribed" id="annotations_subscribed" type="checkbox" <% if preferences.annotations_subscribed %>checked<% end %>>
@@ -252,7 +257,7 @@
                 <% end %>
             <% end %>
 
-            <% if env.get?("user") && CONFIG.admins.includes? env.get?("user").as(User).email %>
+            <% if env.get?("user") && CONFIG.admins.includes? env.get?("user").as(Invidious::User).email %>
                 <legend><%= translate(locale, "preferences_category_admin") %></legend>
 
                 <div class="pure-control-group">

src/invidious/views/user/subscription_manager.ecr

@@ -38,7 +38,7 @@
             <div class="pure-u-1-5" style="text-align:right">
                 <h3 style="padding-right:0.5em">
                     <form data-onsubmit="return_false" action="/subscription_ajax?action_remove_subscriptions=1&c=<%= channel.id %>&referer=<%= env.get("current_page") %>" method="post">
-                        <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                        <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                         <a data-onclick="remove_subscription" data-ucid="<%= channel.id %>" href="#">
                             <input style="all:unset" type="submit" value="<%= translate(locale, "unsubscribe") %>">
                         </a>

src/invidious/views/user/token_manager.ecr

@@ -30,7 +30,7 @@
         <div class="pure-u-1-5" style="text-align:right">
             <h3 style="padding-right:0.5em">
                 <form data-onsubmit="return_false" action="/token_ajax?action_revoke_token=1&session=<%= token[:session] %>&referer=<%= env.get("current_page") %>" method="post">
-                    <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
+                    <input type="hidden" name="csrf_token" value="<%= HTML.escape(env.get?("csrf_token").try &.as(String) || "") %>">
                     <a data-onclick="revoke_token" data-session="<%= token[:session] %>" href="#">
                         <input style="all:unset" type="submit" value="<%= translate(locale, "revoke") %>">
                     </a>

src/invidious/views/watch.ecr

@@ -168,41 +168,7 @@ we're going to need to do it here in order to allow for translations.
                 <% end %>
             <% end %>
 
-            <% if CONFIG.dmca_content.includes?(video.id) || CONFIG.disabled?("downloads") %>
-                <p id="download"><%= translate(locale, "Download is disabled.") %></p>
-            <% else %>
-                <form class="pure-form pure-form-stacked" action="/latest_version" method="get" rel="noopener" target="_blank">
-                    <div class="pure-control-group">
-                        <label for="download_widget"><%= translate(locale, "Download as: ") %></label>
-                        <select style="width:100%" name="download_widget" id="download_widget">
-                            <% fmt_stream.each do |option| %>
-                                <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= URI.encode_www_form(video.title) %>-<%= video.id %>.<%= option["mimeType"].as_s.split(";")[0].split("/")[1] %>"}'>
-                                    <%= itag_to_metadata?(option["itag"]).try &.["height"]? || "~240" %>p - <%= option["mimeType"].as_s.split(";")[0] %>
-                                </option>
-                            <% end %>
-                            <% video_streams.each do |option| %>
-                                <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= URI.encode_www_form(video.title) %>-<%= video.id %>.<%= option["mimeType"].as_s.split(";")[0].split("/")[1] %>"}'>
-                                    <%= option["qualityLabel"] %> - <%= option["mimeType"].as_s.split(";")[0] %> @ <%= option["fps"] %>fps - video only
-                                </option>
-                            <% end %>
-                            <% audio_streams.each do |option| %>
-                                <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= URI.encode_www_form(video.title) %>-<%= video.id %>.<%= option["mimeType"].as_s.split(";")[0].split("/")[1] %>"}'>
-                                    <%= option["mimeType"].as_s.split(";")[0] %> @ <%= option["bitrate"]?.try &.as_i./ 1000 %>k - audio only
-                                </option>
-                            <% end %>
-                            <% captions.each do |caption| %>
-                                <option value='{"id":"<%= video.id %>","label":"<%= caption.name %>","title":"<%= URI.encode_www_form(video.title) %>-<%= video.id %>.<%= caption.language_code %>.vtt"}'>
-                                    <%= translate(locale, "download_subtitles", translate(locale, caption.name)) %>
-                                </option>
-                            <% end %>
-                        </select>
-                    </div>
-
-                    <button type="submit" class="pure-button pure-button-primary">
-                        <b><%= translate(locale, "Download") %></b>
-                    </button>
-                </form>
-            <% end %>
+            <%= Invidious::Frontend::WatchPage.download_widget(locale, video, video_assets) %>
 
             <p id="views"><i class="icon ion-ios-eye"></i> <%= number_with_separator(video.views) %></p>
             <p id="likes"><i class="icon ion-ios-thumbs-up"></i> <%= number_with_separator(video.likes) %></p>