Fixing escapes due to debian security release 2.3.5-1.2+squeeze8

(ActionItem2630)

Fixing escapes due to debian security release 2.3.5-1.2+squeeze8
(ActionItem2630)
Rodrigo Souto
1 parent 1bec32a8
Showing 12 changed files with 54 additions and 56 deletions Show diff stats
app/helpers/application_helper.rb
app/helpers/profile_editor_helper.rb
app/helpers/tags_helper.rb
app/models/article_block.rb
app/models/feed_reader_block.rb
app/models/link_list_block.rb
app/models/profile_list_block.rb
app/models/tags_block.rb
app/models/uploaded_file.rb
app/views/box_organizer/_highlights_block.rhtml
app/views/favorite_enterprises/index.rhtml
app/views/themes/index.rhtml
@@ -493,23 +493,24 @@ module ApplicationHelper
   def profile_cat_icons( profile )
     if profile.class == Enterprise
-      icons =
-        profile.product_categories.map{ |c| c.size > 1 ? c[1] : nil }.
-          compact.uniq.map{ |c|
-            cat_name = c.gsub( /[-_\s,.;'"]+/, '_' )
-            cat_icon = "/images/icons-cat/#{cat_name}.png"
-            if ! File.exists? RAILS_ROOT.to_s() + '/public/' + cat_icon
-              cat_icon = '/images/icons-cat/undefined.png'
-            end
-            content_tag 'span',
-                        content_tag( 'span', c ),
-                        :title => c,
-                        :class => 'product-cat-icon cat_icon_' + cat_name,
-                        :style => "background-image:url(#{cat_icon})"
-          }.join "\n"
-      content_tag 'div',
-                  content_tag( 'span', _('Principal Product Categories'), :class => 'header' ) +"\n"+ icons,
-                  :class => 'product-category-icons'
+      icons = profile.product_categories.map{ |c| c.size > 1 ? c[1] : nil }.
+        compact.uniq.map do |c|
+          cat_name = c.gsub( /[-_\s,.;'"]+/, '_' )
+          cat_icon = "/images/icons-cat/#{cat_name}.png"
+          if ! File.exists? RAILS_ROOT.to_s() + '/public/' + cat_icon
+            cat_icon = '/images/icons-cat/undefined.png'
+          end
+          content_tag('span',
+            content_tag( 'span', c ),
+            :title => c,
+            :class => 'product-cat-icon cat_icon_' + cat_name,
+            :style => "background-image:url(#{cat_icon})"
+          )
+        end.join("\n").html_safe
+        content_tag('div',
+          content_tag( 'span', _('Principal Product Categories'), :class => 'header' ) +"\n"+ icons,
+          :class => 'product-category-icons'
+        )
     else
       ''
     end
@@ -633,10 +634,10 @@ module ApplicationHelper
       # FIXME
       ([toplevel] + toplevel.children_for_menu).each do |cat|
         if cat.top_level?
-          result << '<div class="categorie_box">'
+          result << '<div class="categorie_box">'.html_safe
           result << icon_button( :down, _('open'), '#', :onclick => 'open_close_cat(this); return false' )
           result << content_tag('h5', toplevel.name)
-          result << '<div style="display:none"><ul class="categories">'
+          result << '<div style="display:none"><ul class="categories">'.html_safe
         else
           checkbox_id = "#{object_name}_#{cat.full_name.downcase.gsub(/\s+|\//, '_')}"
           result << content_tag('li', labelled_check_box(
@@ -647,7 +648,7 @@ module ApplicationHelper
                     :class => ( object.category_ids.include?(cat.id) ? 'cat_checked' : '' ) ) + "\n"
         end
       end
-      result << '</ul></div></div>'
+      result << '</ul></div></div>'.html_safe
     end
     content_tag('div', result)
@@ -787,10 +788,10 @@ module ApplicationHelper
             :class => 'lineitem' + (line_item+=1).to_s() ) +"\n"
         if line_item == line_size
           line_item = 0
-          html += "<br />\n"
+          html += "<br />\n".html_safe
         end
       }
-      html += "<br />\n"  if line_size == 0 || ( values.size % line_size ) > 0
+      html += "<br />\n".html_safe if line_size == 0 || ( values.size % line_size ) > 0
       column = object.class.columns_hash[method.to_s]
       text =
         ( column ?
@@ -977,7 +978,7 @@ module ApplicationHelper
   end
   def link_to_email(email)
-    javascript_tag('var array = ' + email.split('@').to_json + '; document.write("<a href=\'mailto:" + array.join("@") + "\'>" + array.join("@") +  "</a>")')
+    javascript_tag('var array = ' + email.split('@').to_json + '; document.write("<a href=\'mailto:" + array.join("@") + "\'>" + array.join("@") +  "</a>")'.html_safe)
   end
   def stylesheet(*args)
@@ -987,7 +988,7 @@ module ApplicationHelper
   def article_to_html(article, options = {})
     options.merge!(:page => params[:npage])
     content = article.to_html(options)
-    content = content.kind_of?(Proc) ? self.instance_eval(&content) : content
+    content = content.kind_of?(Proc) ? self.instance_eval(&content).html_safe : content.html_safe
     @plugins && @plugins.each do |plugin|
       content = plugin.parse_content(content)
     end
@@ -1003,7 +1004,7 @@ module ApplicationHelper
   end
   def ui_icon(icon_class, extra_class = '')
-    "<span class='ui-icon #{icon_class} #{extra_class}' style='float:left; margin-right:7px;'></span>"
+    "<span class='ui-icon #{icon_class} #{extra_class}' style='float:left; margin-right:7px;'></span>".html_safe
   end
   def ui_button(label, url, html_options = {})
@@ -1035,13 +1036,13 @@ module ApplicationHelper
   end
   def collapsed_item_icon
-    "<span class='ui-icon ui-icon-circlesmall-plus' style='float:left;'></span>"
+    "<span class='ui-icon ui-icon-circlesmall-plus' style='float:left;'></span>".html_safe
   end
   def expanded_item_icon
-    "<span class='ui-icon ui-icon-circlesmall-minus' style='float:left;'></span>"
+    "<span class='ui-icon ui-icon-circlesmall-minus' style='float:left;'></span>".html_safe
   end
   def leaf_item_icon
-    "<span class='ui-icon ui-icon-arrow-1-e' style='float:left;'></span>"
+    "<span class='ui-icon ui-icon-arrow-1-e' style='float:left;'></span>".html_safe
   end
   def display_category_menu(block, categories, root = true)
@@ -1300,9 +1301,7 @@ module ApplicationHelper
     titles = tabs.inject(''){ |result, tab| result << content_tag(:li, link_to(tab[:title], '#'+tab[:id]), :class => 'tab') }
     contents = tabs.inject(''){ |result, tab| result << content_tag(:div, tab[:content], :id => tab[:id]) }
-    content_tag :div, :class => 'ui-tabs' do
-      content_tag(:ul, titles) + contents
-    end
+    content_tag(:div, content_tag(:ul, titles) + raw(contents), :class => 'ui-tabs')
   end
   def jquery_token_input_messages_json(hintText = _('Type in an keyword'), noResultsText = _('No results'), searchingText = _('Searching...'))
@@ -136,7 +136,7 @@ module ProfileEditorHelper
     concat(
       content_tag(
         'div',
-        capture(&block) + '<br style="clear:left;"/>&nbsp;',
+        capture(&block) + content_tag('br', '', :style => 'clear: left'),
         :class => 'control-panel')
     )
   end
@@ -68,7 +68,7 @@ module TagsHelper
           :title => n_( 'one item', '%d items', count ) % count
       end
-    end.join("\n")
+    end.join("\n").html_safe
   end
 end
@@ -12,7 +12,7 @@ class ArticleBlock &lt; Block
     block = self
     lambda do
       block_title(block.title) +
-      (block.article ? article_to_html(block.article, :gallery_view => false) : _('Article not selected yet.'))
+      (block.article ? article_to_html(block.article, :gallery_view => false).html_safe : _('Article not selected yet.'))
     end
   end
@@ -47,11 +47,11 @@ class FeedReaderBlock &lt; Block
   def formatted_feed_content
     if error_message.blank?
-      "<ul>\n" +
-      self.feed_items[0..(limit-1)].map{ |item| "<li><a href='#{item[:link]}'>#{item[:title]}</a></li>" }.join("\n") +
-      "</ul>"
+      "<ul>\n".html_safe +
+      self.feed_items[0..(limit-1)].map{ |item| "<li><a href='#{item[:link]}'>#{item[:title]}</a></li>" }.join("\n").html_safe +
+      "</ul>".html_safe
     else
-      '<p>' + error_message + '</p>'
+      "<p>#{error_message}</p>".html_safe
     end
   end
@@ -80,7 +80,7 @@ class LinkListBlock &lt; Block
   def icons_options
     ICONS.map do |i|
-      "<span title=\"#{i[1]}\" class=\"icon-#{i[0]}\" onclick=\"changeIcon(this, '#{i[0]}')\"></span>"
+      "<span title=\"#{i[1]}\" class=\"icon-#{i[0]}\" onclick=\"changeIcon(this, '#{i[0]}')\"></span>".html_safe
     end
   end
@@ -49,13 +49,12 @@ class ProfileListBlock &lt; Block
                send(:profile_image_link, item, :minor )
              }.join("\n  ")
       if list.empty?
-        list = '<div class="common-profile-list-block-none">'+ _('None') +'</div>'
+        list = content_tag 'div', _('None'), :class => 'common-profile-list-block-none'
       else
         list = content_tag 'ul', nl +'  '+ list + nl
       end
       block_title(title) + nl +
-      '<div class="common-profile-list-block">' +
-      nl + list + nl + '<br style="clear:both" /></div>'
+      content_tag('div', nl + list + nl + content_tag('br', '', :style => 'clear:both'))
     end
   end
@@ -30,11 +30,11 @@ class TagsBlock &lt; Block
     end
     block_title(title) +
-    "\n<div class='tag_cloud'>\n"+
+    "\n<div class='tag_cloud'>\n".html_safe+
     tag_cloud( tags, :id,
                owner.public_profile_url.merge(:controller => 'profile', :action => 'tags'),
                :max_size => 16, :min_size => 9 ) +
-    "\n</div><!-- end class='tag_cloud' -->\n";
+    "\n</div><!-- end class='tag_cloud' -->\n".html_safe
   end
   def footer
@@ -113,7 +113,7 @@ class UploadedFile &lt; Article
           content_tag(
             'div',
-            link_to_previous + content_tag('span', _('image %d of %d'), :class => 'total-of-images') % [current_index + 1, total_of_images] + link_to_next,
+            link_to_previous + (content_tag('span', _('image %d of %d'), :class => 'total-of-images') % [current_index + 1, total_of_images]).html_safe + link_to_next,
             :class => 'gallery-navigation'
           )
         end.to_s +
@@ -5,7 +5,7 @@
   <% for image in @block.images do %>
     <tr>
       <td>
-        <%= select_tag 'block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name, image[:image_id].to_i), :style => "width: 100px" %></p>
+        <%= select_tag 'block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name, image[:image_id].to_i).html_safe, :style => "width: 100px" %></p>
       </td>
       <td><%= text_field_tag 'block[images][][address]', image[:address], :class => 'highlight-address', :size => 10 %></td>
       <td><%= text_field_tag 'block[images][][position]', image[:position], :class => 'highlight-position', :size => 3 %></td>
@@ -17,7 +17,7 @@
 <%= link_to_function(_('New highlight'), nil, :class => 'button icon-add with-text') do |page|
     page.insert_html :bottom, 'highlights', content_tag('tr',
-                  content_tag('td', select_tag('block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name), :style => "width: 100px")) +
+                  content_tag('td', select_tag('block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name).html_safe, :style => "width: 100px")) +
                   content_tag('td', text_field_tag('block[images][][address]', nil, :class => 'highlight-address', :size => 10)) +
                   content_tag('td', text_field_tag('block[images][][position]', nil, :class => 'highlight-position', :size => 3)) +
                   content_tag('td', text_field_tag('block[images][][title]', nil, :class => 'highlight-position', :size => 10))
@@ -5,7 +5,7 @@
 <ul class="profile-list">
 <% @favorite_enterprises.each do |enterprise| %>
   <li>
-    <%= link_to_profile profile_image(enterprise) + '<br/>' + enterprise.name,
+    <%= link_to_profile profile_image(enterprise) + '<br/>'.html_safe + enterprise.name,
                         enterprise.identifier, :class => 'profile-link' %>
     <%# profile_image_link enterprise, :portrait, 'div' %>
     <div class="controll">
@@ -11,17 +11,17 @@
         base_content = image_tag(
           "/designs/templates/#{template.id}/thumbnail.png",
           :alt => _('The "%s" template')) +
-        '<div class="opt-info">' +
+        '<div class="opt-info">'.html_safe +
         content_tag('strong', template.id, :class => 'name') +
-        ' <br/> '
+        ' <br/> '.html_safe
         if @current_template == template.id  # selected
           content_tag( 'div',
-            base_content + content_tag('big', _('(current)') ) +'</div>',
+            base_content + content_tag('big', _('(current)') ) +'</div>'.html_safe,
             :class => 'template-opt list-opt selected')
         else  # Not selected
           link_to(
-            base_content +'</div>',
+            base_content +'</div>'.html_safe,
             { :action => 'set_layout_template', :id => template.id },
             :class => 'template-opt list-opt')
         end
@@ -48,17 +48,17 @@
         base_content = image_tag(
           "/designs/themes/#{theme.id}/preview.png",
           :alt => (_('The "%s" theme.') % theme.name)) +
-        '<div class="opt-info">' +
+        '<div class="opt-info">'.html_safe +
         content_tag('strong', theme.name, :class => 'name') +
-        ' <br/> '
+        ' <br/> '.html_safe
         if theme.id == @current_theme  # selected
           content_tag( 'div',
-            base_content + content_tag('big', _('(current)') ) +'</div>',
+            base_content + content_tag('big', _('(current)') ) +'</div>'.html_safe,
             :class => 'theme-opt list-opt selected')
         else  # Not selected
           link_to(
-            base_content + '</div>',
+            base_content + '</div>'.html_safe,
             { :action => 'set', :id => theme.id },
             :class => 'theme-opt list-opt')
         end
	@@ -136,7 +136,7 @@ module ProfileEditorHelper		@@ -136,7 +136,7 @@ module ProfileEditorHelper
136	concat(	136	concat(
137	content_tag(	137	content_tag(
138	'div',	138	'div',
139	- capture(&block) + '<br style="clear:left;"/> ',	139	+ capture(&block) + content_tag('br', '', :style => 'clear: left'),
140	:class => 'control-panel')	140	:class => 'control-panel')
141	)	141	)
142	end	142	end
	@@ -68,7 +68,7 @@ module TagsHelper		@@ -68,7 +68,7 @@ module TagsHelper
68	:title => n_( 'one item', '%d items', count ) % count	68	:title => n_( 'one item', '%d items', count ) % count
69	end	69	end
70		70
71	- end.join("\n")	71	+ end.join("\n").html_safe
72	end	72	end
73		73
74	end	74	end
	@@ -12,7 +12,7 @@ class ArticleBlock < Block		@@ -12,7 +12,7 @@ class ArticleBlock < Block
12	block = self	12	block = self
13	lambda do	13	lambda do
14	block_title(block.title) +	14	block_title(block.title) +
15	- (block.article ? article_to_html(block.article, :gallery_view => false) : _('Article not selected yet.'))	15	+ (block.article ? article_to_html(block.article, :gallery_view => false).html_safe : _('Article not selected yet.'))
16	end	16	end
17	end	17	end
18		18
	@@ -80,7 +80,7 @@ class LinkListBlock < Block		@@ -80,7 +80,7 @@ class LinkListBlock < Block
80		80
81	def icons_options	81	def icons_options
82	ICONS.map do \|i\|	82	ICONS.map do \|i\|
83	- "<span title=\"#{i[1]}\" class=\"icon-#{i[0]}\" onclick=\"changeIcon(this, '#{i[0]}')\"></span>"	83	+ "<span title=\"#{i[1]}\" class=\"icon-#{i[0]}\" onclick=\"changeIcon(this, '#{i[0]}')\"></span>".html_safe
84	end	84	end
85	end	85	end
86		86
	@@ -30,11 +30,11 @@ class TagsBlock < Block		@@ -30,11 +30,11 @@ class TagsBlock < Block
30	end	30	end
31		31
32	block_title(title) +	32	block_title(title) +
33	- "\n<div class='tag_cloud'>\n"+	33	+ "\n<div class='tag_cloud'>\n".html_safe+
34	tag_cloud( tags, :id,	34	tag_cloud( tags, :id,
35	owner.public_profile_url.merge(:controller => 'profile', :action => 'tags'),	35	owner.public_profile_url.merge(:controller => 'profile', :action => 'tags'),
36	:max_size => 16, :min_size => 9 ) +	36	:max_size => 16, :min_size => 9 ) +
37	- "\n</div><!-- end class='tag_cloud' -->\n";	37	+ "\n</div><!-- end class='tag_cloud' -->\n".html_safe
38	end	38	end
39		39
40	def footer	40	def footer
	@@ -113,7 +113,7 @@ class UploadedFile < Article		@@ -113,7 +113,7 @@ class UploadedFile < Article
113		113
114	content_tag(	114	content_tag(
115	'div',	115	'div',
116	- link_to_previous + content_tag('span', _('image %d of %d'), :class => 'total-of-images') % [current_index + 1, total_of_images] + link_to_next,	116	+ link_to_previous + (content_tag('span', _('image %d of %d'), :class => 'total-of-images') % [current_index + 1, total_of_images]).html_safe + link_to_next,
117	:class => 'gallery-navigation'	117	:class => 'gallery-navigation'
118	)	118	)
119	end.to_s +	119	end.to_s +
	@@ -5,7 +5,7 @@		@@ -5,7 +5,7 @@
5	<% for image in @block.images do %>	5	<% for image in @block.images do %>
6	<tr>	6	<tr>
7	<td>	7	<td>
8	- <%= select_tag 'block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name, image[:image_id].to_i), :style => "width: 100px" %></p>	8	+ <%= select_tag 'block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name, image[:image_id].to_i).html_safe, :style => "width: 100px" %></p>
9	</td>	9	</td>
10	<td><%= text_field_tag 'block[images][][address]', image[:address], :class => 'highlight-address', :size => 10 %></td>	10	<td><%= text_field_tag 'block[images][][address]', image[:address], :class => 'highlight-address', :size => 10 %></td>
11	<td><%= text_field_tag 'block[images][][position]', image[:position], :class => 'highlight-position', :size => 3 %></td>	11	<td><%= text_field_tag 'block[images][][position]', image[:position], :class => 'highlight-position', :size => 3 %></td>
	@@ -17,7 +17,7 @@		@@ -17,7 +17,7 @@
17		17
18	<%= link_to_function(_('New highlight'), nil, :class => 'button icon-add with-text') do \|page\|	18	<%= link_to_function(_('New highlight'), nil, :class => 'button icon-add with-text') do \|page\|
19	page.insert_html :bottom, 'highlights', content_tag('tr',	19	page.insert_html :bottom, 'highlights', content_tag('tr',
20	- content_tag('td', select_tag('block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name), :style => "width: 100px")) +	20	+ content_tag('td', select_tag('block[images][][image_id]', content_tag(:option) + option_groups_from_collection_for_select(@block.folder_choices, :images, :name, :id, :name).html_safe, :style => "width: 100px")) +
21	content_tag('td', text_field_tag('block[images][][address]', nil, :class => 'highlight-address', :size => 10)) +	21	content_tag('td', text_field_tag('block[images][][address]', nil, :class => 'highlight-address', :size => 10)) +
22	content_tag('td', text_field_tag('block[images][][position]', nil, :class => 'highlight-position', :size => 3)) +	22	content_tag('td', text_field_tag('block[images][][position]', nil, :class => 'highlight-position', :size => 3)) +
23	content_tag('td', text_field_tag('block[images][][title]', nil, :class => 'highlight-position', :size => 10))	23	content_tag('td', text_field_tag('block[images][][title]', nil, :class => 'highlight-position', :size => 10))
	@@ -5,7 +5,7 @@		@@ -5,7 +5,7 @@
5	<ul class="profile-list">	5	<ul class="profile-list">
6	<% @favorite_enterprises.each do \|enterprise\| %>	6	<% @favorite_enterprises.each do \|enterprise\| %>
7	<li>	7	<li>
8	- <%= link_to_profile profile_image(enterprise) + '<br/>' + enterprise.name,	8	+ <%= link_to_profile profile_image(enterprise) + '<br/>'.html_safe + enterprise.name,
9	enterprise.identifier, :class => 'profile-link' %>	9	enterprise.identifier, :class => 'profile-link' %>
10	<%# profile_image_link enterprise, :portrait, 'div' %>	10	<%# profile_image_link enterprise, :portrait, 'div' %>
11	<div class="controll">	11	<div class="controll">
	@@ -11,17 +11,17 @@		@@ -11,17 +11,17 @@
11	base_content = image_tag(	11	base_content = image_tag(
12	"/designs/templates/#{template.id}/thumbnail.png",	12	"/designs/templates/#{template.id}/thumbnail.png",
13	:alt => _('The "%s" template')) +	13	:alt => _('The "%s" template')) +
14	- '<div class="opt-info">' +	14	+ '<div class="opt-info">'.html_safe +
15	content_tag('strong', template.id, :class => 'name') +	15	content_tag('strong', template.id, :class => 'name') +
16	- ' <br/> '	16	+ ' <br/> '.html_safe
17		17
18	if @current_template == template.id # selected	18	if @current_template == template.id # selected
19	content_tag( 'div',	19	content_tag( 'div',
20	- base_content + content_tag('big', _('(current)') ) +'</div>',	20	+ base_content + content_tag('big', _('(current)') ) +'</div>'.html_safe,
21	:class => 'template-opt list-opt selected')	21	:class => 'template-opt list-opt selected')
22	else # Not selected	22	else # Not selected
23	link_to(	23	link_to(
24	- base_content +'</div>',	24	+ base_content +'</div>'.html_safe,
25	{ :action => 'set_layout_template', :id => template.id },	25	{ :action => 'set_layout_template', :id => template.id },
26	:class => 'template-opt list-opt')	26	:class => 'template-opt list-opt')
27	end	27	end
	@@ -48,17 +48,17 @@		@@ -48,17 +48,17 @@
48	base_content = image_tag(	48	base_content = image_tag(
49	"/designs/themes/#{theme.id}/preview.png",	49	"/designs/themes/#{theme.id}/preview.png",
50	:alt => (_('The "%s" theme.') % theme.name)) +	50	:alt => (_('The "%s" theme.') % theme.name)) +
51	- '<div class="opt-info">' +	51	+ '<div class="opt-info">'.html_safe +
52	content_tag('strong', theme.name, :class => 'name') +	52	content_tag('strong', theme.name, :class => 'name') +
53	- ' <br/> '	53	+ ' <br/> '.html_safe
54		54
55	if theme.id == @current_theme # selected	55	if theme.id == @current_theme # selected
56	content_tag( 'div',	56	content_tag( 'div',
57	- base_content + content_tag('big', _('(current)') ) +'</div>',	57	+ base_content + content_tag('big', _('(current)') ) +'</div>'.html_safe,
58	:class => 'theme-opt list-opt selected')	58	:class => 'theme-opt list-opt selected')
59	else # Not selected	59	else # Not selected
60	link_to(	60	link_to(
61	- base_content + '</div>',	61	+ base_content + '</div>'.html_safe,
62	{ :action => 'set', :id => theme.id },	62	{ :action => 'set', :id => theme.id },
63	:class => 'theme-opt list-opt')	63	:class => 'theme-opt list-opt')
64	end	64	end