Download as
Browse Code »

Commit f16ec7f40f8a718f3860db79ebf6a17ce30f462e

Authored by Victor Costa
1 parent c40bc786
Exists in staging and in 4 other branches external_followers, follower_permition, master, production

Not escape html in people suggestions

Showing 2 changed files with 3 additions and 3 deletions   Show diff stats
app/helpers/application_helper.rb
  Diff comments   View file @f16ec7f
... ... @@ -1183,10 +1183,10 @@ module ApplicationHelper
1183 1183 end
1184 1184  
1185 1185 controller_target = suggestion.suggestion_type == 'Person' ? :friends : :memberships
1186   - profiles << link_to("<big> +#{suggestion.profile_connections.count - 4}</big>", :controller => controller_target, :action => :connections, :id => suggestion.suggestion_id) if suggestion.profile_connections.count > 4
  1186 + profiles << link_to("<big> +#{suggestion.profile_connections.count - 4}</big>".html_safe, :controller => controller_target, :action => :connections, :id => suggestion.suggestion_id) if suggestion.profile_connections.count > 4
1187 1187  
1188 1188 if profiles.present?
1189   - content_tag(:div, profiles.join , :class => 'profile-connections')
  1189 + content_tag(:div, profiles.safe_join , :class => 'profile-connections')
1190 1190 else
1191 1191 ''
1192 1192 end
... ...
app/views/shared/_profile_connections.html.erb
  Diff comments   View file @f16ec7f
... ... @@ -4,7 +4,7 @@
4 4 <ul class="profile-list">
5 5 <% profiles.each do |profile| %>
6 6 <li>
7   - <%= link_to_profile profile_image(profile) + '<br/>' + profile.short_name,
  7 + <%= link_to_profile profile_image(profile) + '<br/>'.html_safe + profile.short_name,
8 8 profile.identifier, :class => 'profile-link' %>
9 9 </li>
10 10 <% end %>
... ...