redmine_plugins/redmine_dmsf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1060 from ahorek/xss-fix

Browse Source 
XSS fix
This commit is contained in:
Karel Picman 2019-12-04 10:38:43 +01:00 committed by GitHub
commit 133dc24ad4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/dmsf_files/show.html.erb
View File

@ -112,7 +112,7 @@
<% if revision.description.present? %>
<div class="status attribute">
<%= content_tag :div, l(:label_description), :class => 'label' %>
<% text = clean_wiki_text(textilizable(revision.description)) %>
<% text = clean_wiki_text(textilizable(h revision.description)) %>
<%= content_tag :div, text.html_safe, :class => 'value wiki' %>
</div>
<% end %>
@ -141,7 +141,7 @@
<% if revision.comment.present? %>
<div class="status attribute">
<%= content_tag :div, l(:label_comment), :class => 'label' %>
<% text = clean_wiki_text(textilizable(revision.comment)) %>
<% text = clean_wiki_text(textilizable(h revision.comment)) %>
<%= content_tag :div, text.html_safe, :class => 'value wiki' %>
</div>
<% end %>

4
lib/redmine_dmsf/hooks/views/issue_view_hooks.rb
View File

@ -208,11 +208,11 @@ module RedmineDmsf
:title => h(dmsf_file.last_revision.try(:tooltip)),
'data-downloadurl' => "#{dmsf_file.last_revision.detect_content_type}:#{h(dmsf_file.name)}:#{file_view_url}")
html << "<span class=\"size\">(#{number_to_human_size(dmsf_file.last_revision.size)})</span>"
html << " - #{dmsf_file.description}" unless dmsf_file.description.blank?
html << " - #{h(dmsf_file.description)}" unless dmsf_file.description.blank?
html << '</td>'
# Author, updated at
html << '<td>'
html << "<span class=\"author\">#{dmsf_file.last_revision.user}, #{format_time(dmsf_file.last_revision.updated_at)}</span>"
html << "<span class=\"author\">#{h(dmsf_file.last_revision.user)}, #{format_time(dmsf_file.last_revision.updated_at)}</span>"
html << '</td>'
# Command icons
html << '<td class="fast-icons easy-query-additional-ending-buttons hide-when-print">'