various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/models/custom_field.rb

@@ -28,6 +28,7 @@ class CustomField < ActiveRecord::Base
 
   validates_presence_of :name, :field_format
   validates_uniqueness_of :name
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
   validates_inclusion_of :field_format, :in => FIELD_FORMATS.keys
   validates_presence_of :possible_values, :if => Proc.new { |field| field.field_format == "list" }
 

app/models/enumeration.rb

@@ -18,8 +18,9 @@
 class Enumeration < ActiveRecord::Base
   before_destroy :check_integrity
   
-	validates_presence_of :opt, :name
-	validates_uniqueness_of :name, :scope => [:opt]
+  validates_presence_of :opt, :name
+  validates_uniqueness_of :name, :scope => [:opt]
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
 	
 	OPTIONS = {
 	  "IPRI" => :enumeration_issue_priorities,

app/models/issue_status.rb

@@ -21,6 +21,7 @@ class IssueStatus < ActiveRecord::Base
 
   validates_presence_of :name
   validates_uniqueness_of :name
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
   validates_length_of :html_color, :is => 6
   validates_format_of :html_color, :with => /^[a-f0-9]*$/i
 

app/models/project.rb

@@ -31,6 +31,7 @@ class Project < ActiveRecord::Base
   validates_presence_of :name, :description
   validates_uniqueness_of :name
   validates_associated :custom_values, :on => :update
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
 
   # returns 5 last created projects
   def self.latest

app/models/role.rb

@@ -23,6 +23,7 @@ class Role < ActiveRecord::Base
 
   validates_presence_of :name
   validates_uniqueness_of :name
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
 
 private
   def check_integrity

app/models/tracker.rb

@@ -23,7 +23,8 @@ class Tracker < ActiveRecord::Base
 
   validates_presence_of :name
   validates_uniqueness_of :name
-  
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
+
 private
   def check_integrity
     raise "Can't delete tracker" if Issue.find(:first, :conditions => ["tracker_id=?", self.id])

app/models/user.rb

@@ -32,7 +32,8 @@ class User < ActiveRecord::Base
   validates_presence_of :login, :firstname, :lastname, :mail
   validates_uniqueness_of :login, :mail	
   # Login must contain lettres, numbers, underscores only
-  validates_format_of :login, :with => /^[a-z0-9_]+$/i
+  validates_format_of :firstname, :lastname, :with => /^[\w\s\'\-]*$/i
+  validates_format_of :login, :with => /^[a-z0-9_\-@\.]+$/i
   validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i
   # Password length between 4 and 12
   validates_length_of :password, :in => 4..12, :allow_nil => true