From 1a247e1889ede0401534ca6cfdb44662b5fc234f Mon Sep 17 00:00:00 2001
From: Mischa <mischa@gorinskat.nl>
Date: Fri, 19 Jun 2026 23:12:47 +0200
Subject: [PATCH] fix: story template-story class, datetime attr, imageName
 escaping, raw content comments

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vgmzx8VTTTmCskSpQtsLTr
---
 plugins/story-blocks/shortcodes/ChapterBreakShortcode.php   | 2 +-
 plugins/story-blocks/shortcodes/PullQuoteShortcode.php      | 4 ++--
 plugins/story-blocks/shortcodes/ScrollySectionShortcode.php | 4 ++--
 plugins/story-blocks/shortcodes/SnapGalleryShortcode.php    | 2 +-
 themes/intotheeast/templates/partials/base.html.twig        | 2 +-
 themes/intotheeast/templates/stories.html.twig              | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php b/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php
index 5a6edc8..2ebb813 100644
--- a/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php
+++ b/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php
@@ -11,7 +11,7 @@ class ChapterBreakShortcode extends Shortcode
             $plugin = $this->grav['plugins']->getPlugin('story-blocks');
             $page   = $plugin ? $plugin->getCurrentPage() : null;
 
-            $imageName = $sc->getParameter('image', '');
+            $imageName = htmlspecialchars($sc->getParameter('image', ''), ENT_QUOTES);
             $title     = htmlspecialchars($sc->getParameter('title', ''), ENT_QUOTES);
             $number    = htmlspecialchars($sc->getParameter('number', ''), ENT_QUOTES);
             $alt       = htmlspecialchars($sc->getParameter('alt', $title), ENT_QUOTES);
diff --git a/plugins/story-blocks/shortcodes/PullQuoteShortcode.php b/plugins/story-blocks/shortcodes/PullQuoteShortcode.php
index 4401f7d..78e5981 100644
--- a/plugins/story-blocks/shortcodes/PullQuoteShortcode.php
+++ b/plugins/story-blocks/shortcodes/PullQuoteShortcode.php
@@ -11,9 +11,9 @@ class PullQuoteShortcode extends Shortcode
             $plugin    = $this->grav['plugins']->getPlugin('story-blocks');
             $page      = $plugin ? $plugin->getCurrentPage() : null;
 
-            $imageName = $sc->getParameter('image', '');
+            $imageName = htmlspecialchars($sc->getParameter('image', ''), ENT_QUOTES);
             $alt       = htmlspecialchars($sc->getParameter('alt', ''), ENT_QUOTES);
-            $content   = trim($sc->getContent());
+            $content   = trim($sc->getContent()); // ShortcodeCore renders inner Markdown to HTML; trusted author content
             $imageUrl  = ($page && $imageName) ? $page->url() . '/' . $imageName : '';
 
             $bgHtml = '';
diff --git a/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php b/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php
index 077829e..736f47e 100644
--- a/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php
+++ b/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php
@@ -11,10 +11,10 @@ class ScrollySectionShortcode extends Shortcode
             $plugin    = $this->grav['plugins']->getPlugin('story-blocks');
             $page      = $plugin ? $plugin->getCurrentPage() : null;
 
-            $imageName = $sc->getParameter('image', '');
+            $imageName = htmlspecialchars($sc->getParameter('image', ''), ENT_QUOTES);
             $alt       = htmlspecialchars($sc->getParameter('alt', ''), ENT_QUOTES);
             $caption   = htmlspecialchars($sc->getParameter('caption', ''), ENT_QUOTES);
-            $content   = $sc->getContent(); /* raw inner content — Scrollama JS splits on <hr> */
+            $content   = $sc->getContent(); // ShortcodeCore renders inner Markdown to HTML; trusted author content
             $imageUrl  = ($page && $imageName) ? $page->url() . '/' . $imageName : $imageName;
 
             $captionHtml = $caption
diff --git a/plugins/story-blocks/shortcodes/SnapGalleryShortcode.php b/plugins/story-blocks/shortcodes/SnapGalleryShortcode.php
index 7e83bf1..3357687 100644
--- a/plugins/story-blocks/shortcodes/SnapGalleryShortcode.php
+++ b/plugins/story-blocks/shortcodes/SnapGalleryShortcode.php
@@ -21,7 +21,7 @@ class SnapGalleryShortcode extends Shortcode
 
             foreach ($images as $i => $filename) {
                 if (!$filename) continue;
-                $url     = $baseUrl . $filename;
+                $url     = $baseUrl . htmlspecialchars($filename, ENT_QUOTES);
                 $caption = htmlspecialchars($captions[$i] ?? '', ENT_QUOTES);
                 $alt     = htmlspecialchars($alts[$i] ?? '', ENT_QUOTES);
                 $eager   = $i === 0 ? 'eager' : 'lazy';
diff --git a/themes/intotheeast/templates/partials/base.html.twig b/themes/intotheeast/templates/partials/base.html.twig
index ba860f4..a97cc43 100644
--- a/themes/intotheeast/templates/partials/base.html.twig
+++ b/themes/intotheeast/templates/partials/base.html.twig
@@ -12,7 +12,7 @@
     {{ assets.css()|raw }}
     {{ assets.js()|raw }}
 </head>
-<body class="{% if page.template == 'map' %}map-page{% endif %}{% if page.template == 'home' or page.template == 'trip' %} home-page{% endif %}">
+<body class="{% if page.template == 'map' %}map-page{% endif %}{% if page.template == 'home' or page.template == 'trip' %} home-page{% endif %}{% if page.template == 'story' %} template-story{% endif %}">
     <header class="site-header">
         <a class="site-title" href="{{ base_url_absolute }}">into the east</a>
         {% block nav %}
diff --git a/themes/intotheeast/templates/stories.html.twig b/themes/intotheeast/templates/stories.html.twig
index b6953d8..aa373f9 100644
--- a/themes/intotheeast/templates/stories.html.twig
+++ b/themes/intotheeast/templates/stories.html.twig
@@ -28,7 +28,7 @@
             <div class="story-card__photo story-card__photo--empty"></div>
             {% endif %}
             <div class="story-card__body">
-                <time class="story-card__date">{{ date_str }}</time>
+                <time class="story-card__date" datetime="{{ story.date|date('Y-m-d') }}">{{ date_str }}</time>
                 {% if story.header.location_name %}
                 <span class="story-card__location">📍 {{ story.header.location_name }}{% if story.header.location_country %}, {{ story.header.location_country }}{% endif %}</span>
                 {% endif %}