Download as
Browse Code »

Commit 6f15dc60a46b77d79fe9c06bb70b45235935e869

Authored by Melissa Wen
1 parent eb631713
Exists in staging and in 22 other branches all_pending_tasks_api, api_roles, comments_permissions, elasticsearch, elasticsearch_categories, elasticsearch_filter, elasticsearch_sort, elasticsearch_to_merge, environment-exposes-api, export-comment-api, external_followers, federation_oauth_provider, follower_permition, master, master_profile_followers, oauth_external_login, oauth_login, private-scraps, private-scraps-rebase, production, profile_api_improvements, user_mention

not escape HTML of link to read more article on blog index with short format

Showing 2 changed files with 13 additions and 2 deletions   Show diff stats
app/helpers/application_helper.rb
  Diff comments   View file @6f15dc6
@@ -723,11 +723,11 @@ module ApplicationHelper @@ -723,11 +723,11 @@ module ApplicationHelper
723 def display_short_format(article, options={}) 723 def display_short_format(article, options={})
724 options[:comments_link] ||= true 724 options[:comments_link] ||= true
725 options[:read_more_link] ||= true 725 options[:read_more_link] ||= true
  726 + lead_links = (options[:comments_link] ? link_to_comments(article) : '') + (options[:read_more_link] ? reference_to_article( _('Read more'), article) : '')
726 html = content_tag('div', 727 html = content_tag('div',
727 article.lead + 728 article.lead +
728 content_tag('div', 729 content_tag('div',
729 - (options[:comments_link] ? link_to_comments(article) : '') +  
730 - (options[:read_more_link] ? reference_to_article( _('Read more'), article) : ''), 730 + lead_links.html_safe,
731 :class => 'read-more' 731 :class => 'read-more'
732 ), 732 ),
733 :class => 'short-post' 733 :class => 'short-post'
test/integration/safe_strings_test.rb
  Diff comments   View file @6f15dc6
@@ -175,4 +175,15 @@ class SafeStringsTest < ActionDispatch::IntegrationTest @@ -175,4 +175,15 @@ class SafeStringsTest < ActionDispatch::IntegrationTest
175 assert_select '.icon-selector .icon-edit' 175 assert_select '.icon-selector .icon-edit'
176 end 176 end
177 177
  178 + should 'not escape read more link to article on display short format' do
  179 + profile = fast_create Profile
  180 + blog = fast_create Blog, :name => 'Blog', :profile_id => profile.id
  181 + fast_create(TinyMceArticle, :name => "Post Test", :profile_id => profile.id, :parent_id => blog.id, :accept_comments => false, :body => '<p>Lorem ipsum dolor sit amet</p>')
  182 + blog.update_attribute(:visualization_format, 'short')
  183 +
  184 + get "/#{profile.identifier}/blog"
  185 + assert_tag :tag => 'div', :attributes => {:class => 'read-more'}, :child => {:tag => 'a', :content => 'Read more'}
  186 + end
  187 +
  188 +
178 end 189 end