Download as
Browse Code »

Commit 0834f87c5e29abdf0525c080c955effb2952ccc1

Authored by Joenio Costa
1 parent e73ac0c3
Exists in staging and in 29 other branches all_pending_tasks_api, api_roles, comments_permissions, elasticsearch, elasticsearch_api, elasticsearch_categories, elasticsearch_filter, elasticsearch_sort, elasticsearch_to_merge, elasticsearch_view, environment-exposes-api, export-comment-api, export_data, external_followers, federation-webfinger, federation_followers, federation_followers_backend, federation_oauth_provider, federation_webfinger, follower_permition, master, master_profile_followers, oauth_external_login, oauth_login, private-scraps, private-scraps-rebase, production, profile_api_improvements, user_mention

not escape HTML from newsletter moderation tasks

Showing 2 changed files with 34 additions and 3 deletions   Show diff stats
plugins/newsletter/test/integration/safe_strings_test.rb 0 → 100644
  Diff comments   View file @0834f87
... ... @@ -0,0 +1,31 @@
  1 +require 'test_helper'
  2 +
  3 +class NewsletterPluginSafeStringsTest < ActionDispatch::IntegrationTest
  4 +
  5 + should 'not escape HTML from newsletter pending task' do
  6 + environment = Environment.default
  7 + environment.enable_plugin('newsletter')
  8 + person = create_user('john', :environment_id => environment.id, :password => 'test', :password_confirmation => 'test').person
  9 + person.user.activate
  10 + environment.add_admin(person)
  11 +
  12 + blog = fast_create(Blog, :profile_id => person.id)
  13 + post = fast_create(TextileArticle, :name => 'First post', :profile_id => person.id, :parent_id => blog.id, :body => 'Test')
  14 + newsletter = NewsletterPlugin::Newsletter.create!(:environment => environment, :person => person, :enabled => true)
  15 + newsletter.blog_ids = [blog.id]
  16 + newsletter.save!
  17 + task = NewsletterPlugin::ModerateNewsletter.create!(
  18 + :newsletter_id => newsletter.id,
  19 + :target => environment,
  20 + :post_ids => [post.id.to_s]
  21 + )
  22 +
  23 + login 'john', 'test'
  24 + get '/myprofile/john/tasks'
  25 +
  26 + assert_tag :tag => 'input',
  27 + :attributes => { :type => 'checkbox', :name => "tasks[#{task.id}][task][post_ids][]" },
  28 + :sibling => { :tag => 'span' }
  29 + end
  30 +
  31 +end
... ...
plugins/newsletter/views/tasks/newsletter_plugin/_moderate_newsletter_accept_details.html.erb
  Diff comments   View file @0834f87
... ... @@ -9,9 +9,9 @@
9 9 <% input_name = "tasks[#{task.id}][task][post_ids][]" %>
10 10 <% post_check_box = hidden_field_tag(input_name, '0') +check_box_tag(input_name, post.id, true) %>
11 11  
12   - <% newsletter_content.gsub!(/<span([^>]*?) id="#{post.id}"/, post_check_box + '<span\\1')%>
13   - <% newsletter_content.gsub!(/<img([^>]*?) id="#{post.id}"/, post_check_box + '<img\\1') %>
  12 + <% newsletter_content.gsub!(/<span([^>]*?) id="#{post.id}"/, post_check_box + '<span\\1'.html_safe) %>
  13 + <% newsletter_content.gsub!(/<img([^>]*?) id="#{post.id}"/, post_check_box + '<img\\1'.html_safe) %>
14 14 <% end %>
15 15  
16   - <%= newsletter_content %>
  16 + <%= newsletter_content.html_safe %>
17 17 </div>
... ...