Reference recipes

[seyfeb]

Added functionality to reference other recipes by id in description, tools, ingredients, and instructions

• In recipe editor, when entering '#' a popup with a multiselect is shown that allows selecting a reference.
• the popup is shown in fullscreen for small window widths
• When selecting a recipe a reference is entered: #r/123
• in recipe viewer this is converted to #123 linking to the recipe page

Closes #209

[codecov]

Codecov Report

Merging #562 (ee8521b) into master (6b8cdf0) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##             master    #562   +/-   ##
========================================
  Coverage      1.01%   1.01%           
  Complexity      440     440           
========================================
  Files            13      13           
  Lines          1381    1381           
========================================
  Hits             14      14           
  Misses         1367    1367           

Flag	Coverage Δ	Complexity Δ
integration	0.00% <ø> (ø)	0.00 <ø> (ø)
unittests	1.01% <ø> (ø)	0.00 <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[christianlupus]

I will have to play with the PR a bit. There are quite some changes so I cannot oversee statically fi this will work.

I have two points seen during a quick look at the code:

1. Usage if v-html must be used carefully. This allows CSRF attacks if corresponding HTML code is embedded in the corresponding texts. This must be carefully checked and eventually escaped.
2. This will conflict heavily with Markdown for description #381.

[seyfeb]

I will have to play with the PR a bit. There are quite some changes so I cannot oversee statically fi this will work.

Definitely. The main change (in lines of code) is certainly the new component EditMultiselectPopup.vue. In the input fields, registering the # press and pasting the reference is done. In the RecipeView component the references are converted to links.

1. Usage if v-html must be used carefully. This allows CSRF attacks if corresponding HTML code is embedded in the corresponding texts. This must be carefully checked and eventually escaped.

That is a good point. As Vue does this automatically in most cases I sometimes forget about it. I add some escaping mechanism before inserting it there.

2. This will conflict heavily with Markdown for description #381.

It conflicts, but I hope™ that it’s easily fixable.

[seyfeb]

I merged the Markdown support and rebased / extended this PR on this basis. It should work for both markdown and non-markdown input fields now!

[christianlupus]

There is one issue with the Changelog that must be tackled and a few minor things that can be taken care of but are mainly border cases.

Apart from these it seems to work and can be merged once these are ironed out.

[christianlupus]

You might want to have a look at the minor change I suggested but apart from that I think, this can be merged.