dinislage/redmine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

various modifications to prevent xss

Browse Source 
- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2006-12-17 08:10:18 +00:00
parent 3e28dc669b
commit 2b86ef8e28
34 changed files with 73 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/helpers/issues_helper.rb
+3 -3
View File
@@ -56,9 +56,9 @@ module IssuesHelper
unless no_html
label = content_tag('strong', label)
old_value = content_tag("i", old_value) if old_value
old_value = content_tag("strike", old_value) if old_value and !value
value = content_tag("i", value) if value
old_value = content_tag("i", h(old_value)) if old_value
old_value = content_tag("strike", h(old_value)) if old_value and !value
value = content_tag("i", h(value)) if value
end
if value