dinislage/redmine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

various modifications to prevent xss

Browse Source 
- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2006-12-17 08:10:18 +00:00
parent 3e28dc669b
commit 2b86ef8e28
34 changed files with 73 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/views/projects/list_issues.rhtml
+1 -1
View File
@@ -69,7 +69,7 @@
<td align="center"><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %></td>
<td align="center" style="font-weight:bold;color:#<%= issue.status.html_color %>;"><%= issue.status.name %></font></td>
<td align="center"><%= issue.tracker.name %></td>
<td><%= link_to issue.subject, :controller => 'issues', :action => 'show', :id => issue %></td>
<td><%= link_to h(issue.subject), :controller => 'issues', :action => 'show', :id => issue %></td>
<td align="center"><%= issue.author.display_name %></td>
<td align="center"><%= format_time(issue.created_on) %></td>
<td align="center"><%= format_time(issue.updated_on) %></td>