Merge branch 'main' of https://github.com/classroomio/classroomio into feat/release-v2

apps/dashboard/src/lib/components/Course/components/Ceritficate/Design.svelte

@@ -45,6 +45,12 @@
     isSaving = true;
 
     try {
+      // Prevent free plan users from bypassing UI restrictions  
+      if ($isFreePlan) {
+        errors.description = 'Certificate customization is only available on paid plans';
+        throw new Error(errors.description);
+      }
+
       const result = saveCertificateValidation({
         description: $course.description || '',
         is_certificate_downloadable: $course.is_certificate_downloadable || false,

apps/dashboard/src/lib/components/Course/components/Lesson/Exercise/UpdateDescription.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { questionnaire } from '../store/exercise';
+  import { sanitizeHtml } from '@cio/ui/tools/sanitize';
   import { t } from '$lib/utils/functions/translations';
 
   import { InputField } from '@cio/ui/custom/input-field';
@@ -80,7 +81,9 @@
       </div>
 
       <article class="preview prose prose-sm sm:prose mt-3 p-2">
-        {@html $questionnaire.description || $t('course.navItem.lessons.exercises.all_exercises.description.no')}
+        {@html sanitizeHtml(
+          $questionnaire.description || $t('course.navItem.lessons.exercises.all_exercises.description.no')
+        )}
       </article>
     {/if}
   </QuestionContainer>

apps/dashboard/src/lib/components/Course/components/Lesson/Exercise/ViewMode.svelte

@@ -25,6 +25,7 @@
   import { NOTIFICATION_NAME, triggerSendEmail } from '$lib/utils/services/notification/notification';
   import { lesson } from '../store/lessons';
   import { COURSE_TYPE } from '$lib/utils/types';
+  import { sanitizeHtml } from '@cio/ui/tools/sanitize';
   import { t } from '$lib/utils/functions/translations';
 
   interface Props {
@@ -297,7 +298,7 @@
       </div>
 
       <article class="preview prose prose-sm sm:prose mt-3 p-2">
-        {@html $questionnaire.description || 'No desription'}
+        {@html sanitizeHtml($questionnaire.description || 'No desription')}
       </article>
 
       <Button onclick={handleStart} type="button" class="float-right my-5">Start</Button>

apps/dashboard/src/lib/components/Course/components/Lesson/LessonVersionHistory.svelte

@@ -9,6 +9,7 @@
   import { diffLines } from 'diff';
   import { lesson, lessons } from '$lib/components/Course/components/Lesson/store/lessons';
   import { supabase } from '$lib/utils/functions/supabase';
+  import { sanitizeHtml } from '@cio/ui/tools/sanitize';
   import { t } from '$lib/utils/functions/translations';
 
   import { snackbar } from '$features/ui/snackbar/store';
@@ -194,7 +195,7 @@
         {#key lessonId}
           <HtmlRender id="display" className="m-auto">
             <div class="amen">
-              {@html content}
+              {@html sanitizeHtml(content)}
             </div>
           </HtmlRender>
         {/key}

apps/dashboard/src/lib/components/Course/components/Lesson/Materials/Document/AddDocumentToLesson.svelte

@@ -101,6 +101,14 @@
 
   async function uploadDocument() {
     if (!selectedFile) return;
+    
+    // Prevent free plan users from bypassing UI restrictions
+    if ($isFreePlan) {
+      $lessonDocUpload.error = $t('upgrade.required');
+      snackbar.error($lessonDocUpload.error);
+      return;
+    }
+    
     $lessonDocUpload.isUploading = true;
 
     try {

apps/dashboard/src/lib/components/Course/components/Lesson/Materials/Video/UploadVideo.svelte

@@ -36,6 +36,17 @@
   async function onUpload() {
     if (!fileInput) return;
 
+    // Prevent free plan users from bypassing UI restrictions
+    if ($isFreePlan) {
+      formRes = {
+        type: 'AUTHORIZATION_ERROR', 
+        status: 403,
+        message: $t('upgrade.required')
+      };
+      isLoaded = true;
+      return;
+    }
+
     videoUploader.initUpload();
 
     const videoFile = fileInput.files?.[0];

apps/dashboard/src/lib/components/Course/components/Lesson/Materials/components/ComponentNote.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import HtmlRender from '$lib/components/HTMLRender/HTMLRender.svelte';
+  import { sanitizeHtml } from '@cio/ui/tools/sanitize';
   import { isHtmlValueEmpty } from '$lib/utils/functions/toHtml';
   import { lesson, lessonByTranslation } from '$lib/components/Course/components/Lesson/store/lessons';
   import { t } from '$lib/utils/functions/translations';
@@ -22,7 +23,7 @@
 {#if !isHtmlValueEmpty(content)}
   <HtmlRender className="m-auto">
     <div>
-      {@html content}
+      {@html sanitizeHtml(content)}
     </div>
   </HtmlRender>
 {:else if hasAtLeastOneTranslation}

apps/dashboard/src/lib/components/Course/components/NewsFeed/NewsFeedCard.svelte

@@ -11,6 +11,7 @@
   import { calDateDiff } from '$lib/utils/functions/date';
   import type { Author, Feed } from '$lib/utils/types/feed';
   import { isHtmlValueEmpty } from '$lib/utils/functions/toHtml';
+  import { sanitizeHtml } from '@cio/ui/tools/sanitize';
   import { addNewsfeedCommentValidation } from '$lib/utils/functions/validator';
   import { isNewFeedModal } from '$lib/components/Course/components/NewsFeed/store';
 
@@ -162,7 +163,7 @@
       {#if !isHtmlValueEmpty(feed.content)}
         <HtmlRender className="text-sm font-medium w-[80%] mb-4">
           <div>
-            {@html feed.content}
+            {@html sanitizeHtml(feed.content)}
           </div>
         </HtmlRender>
       {/if}

apps/dashboard/src/lib/components/Course/store.ts

@@ -124,12 +124,13 @@ export async function setCourse(data: Course, setLesson = true) {
   if (!data || !(Object.values(data) && Object.values(data).length)) return;
 
   if (data.group) {
-    const groupData: GroupStore = {
-      id: data.group.id,
+    const copiedGroup = JSON.parse(JSON.stringify(data.group));
+    const groupData = Object.assign(copiedGroup, {
+      id: copiedGroup.id,
       tutors: [],
       students: [],
       people: []
-    };
+    });
 
     if (Array.isArray(data.group.members)) {
       for (const member of data.group.members) {