redmine_plugins/redmine_dmsf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

XSS fix

Browse Source
This commit is contained in:
karel.picman@lbcfree.net 2021-02-23 12:49:42 +01:00
parent 7414e5ee31
commit f7a3a053e1
5 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/dmsf_controller.rb
View File

@ -630,7 +630,7 @@ class DmsfController < ApplicationController
recipients = DmsfMailer.deliver_files_deleted(@project, deleted_files)
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
if recipients.any?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
flash[:warning] = l(:warning_email_notifications, to: to)
end

4
app/controllers/dmsf_files_controller.rb
View File

@ -178,7 +178,7 @@ class DmsfFilesController < ApplicationController
recipients = DmsfMailer.deliver_files_updated(@project, [@file])
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
if recipients.any?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
flash[:warning] = l(:warning_email_notifications, to: to)
end
@ -208,7 +208,7 @@ class DmsfFilesController < ApplicationController
recipients = DmsfMailer.deliver_files_deleted(@project, [@file])
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
if recipients.any?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
flash[:warning] = l(:warning_email_notifications, to: to)
end

8
app/controllers/dmsf_workflows_controller.rb
View File

@ -84,7 +84,7 @@ class DmsfWorkflowsController < ApplicationController
:text_email_to_see_history)
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
unless recipients.blank?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
flash[:warning] = l(:warning_email_notifications, to: to)
end
@ -105,7 +105,7 @@ class DmsfWorkflowsController < ApplicationController
action.note)
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
unless recipients.blank?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
flash[:warning] = l(:warning_email_notifications, to: to)
end
@ -126,7 +126,7 @@ class DmsfWorkflowsController < ApplicationController
action.note,
action.dmsf_workflow_step_assignment.dmsf_workflow_step)
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
flash[:warning] = l(:warning_email_notifications, to: delegate.name)
flash[:warning] = l(:warning_email_notifications, to: h(delegate.name))
end
end
else
@ -164,7 +164,7 @@ class DmsfWorkflowsController < ApplicationController
recipients.uniq!
recipients = recipients & DmsfMailer.get_notify_users(@project, [revision.dmsf_file], true)
unless recipients.empty?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
flash[:warning] = l(:warning_email_notifications, to: to)
end

2
app/helpers/dmsf_upload_helper.rb
View File

@ -152,7 +152,7 @@ module DmsfUploadHelper
recipients = DmsfMailer.deliver_files_updated(project, files)
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
unless recipients.empty?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
controller.flash[:warning] = l(:warning_email_notifications, to: to) if controller
end

2
app/models/dmsf_workflow.rb
View File

@ -223,7 +223,7 @@ class DmsfWorkflow < ActiveRecord::Base
assignments.first&.dmsf_workflow_step)
if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
unless recipients.blank?
to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
controller.flash[:warning] = l(:warning_email_notifications, to: to) if controller
end