06/15 Fix issues

app/blueprints/messaging/routes.py

@@ -11,6 +11,7 @@ from app.services import messaging as msvc
 from app.services import favorites as fsvc
 from app.services.contact import contact_revealed, mask_body
 from app.blueprints.messaging.forms import MessageForm
+from app.utils import safe_referrer
 
 messaging_bp = Blueprint("messaging", __name__)
 
@@ -37,6 +38,7 @@ def conversation(conv_id):
         abort(403)
 
     msvc.mark_conversation_read(conv, current_user)
+    # reveal controls the "contact info hidden" banner for the current reader
     reveal = contact_revealed(current_user)
     form = MessageForm()
 
@@ -47,9 +49,10 @@ def conversation(conv_id):
         except msvc.MessagingError as e:
             flash(str(e), "danger")
 
-    # mask contact info in messages for low-trust users
+    # Mask is based on the *sender's* trust so a low-trust sender cannot
+    # slip contact info through to a trusted reader.
     masked_messages = [
-        (msg, mask_body(msg.body, reveal=reveal))
+        (msg, mask_body(msg.body, reveal=contact_revealed(msg.sender)))
         for msg in conv.messages
     ]
     return render_template("messaging/conversation.html",
@@ -103,8 +106,8 @@ def toggle_favorite(listing_id):
     if request.headers.get("X-Requested-With") == "XMLHttpRequest":
         return jsonify(favorited=now_fav)
     flash(_("Saved.") if now_fav else _("Removed from saved."), "info")
-    return redirect(request.referrer or url_for("listings.detail",
-                                                listing_id=listing_id))
+    return redirect(safe_referrer(url_for("listings.detail",
+                                         listing_id=listing_id)))
 
 
 @messaging_bp.route("/my/favorites")