1
Download as
Browse Code »

Commit 4075f24dc1d96791bc361c336efd459a26ffdcd6

Authored by Larissa Reis
1 parent 92476194
Exists in master and in 20 other branches add_member_task_reject_details, admin_visible_profile, community_notifications, fix_comments_pagination, fix_rails4_organization_ratings, fix_sign_up_form, follow_step_fix, forum_topic_creation, mirror_block_improvements, multi_env_on_remote_user, new_security, organization_ratings_improvements, profile_api_improvements, ratings_minor_fixes, send_email_to_admins, stable-spb-1.4, stable-spb-1.5, suggest_rejected_value, web_steps_improvements, xss_terminate_custom_options

newsletter: whitelist only text for article in newsletter 

  The only image for an article in the newsletter has to be the
  article's image. The lead for the article also can't have any
  paragraph or other crazy stuff.

  Instead of manually using gsub to remove undesired tags, I'm using
  ActionView::Helpers::SanitizeHelper#sanitize and whitelisting only
  tags for emphasis in text.
Showing 2 changed files with 20 additions and 9 deletions   Show diff stats
plugins/newsletter/lib/newsletter_plugin/newsletter.rb
  Diff comments   View file @4075f24
@@ -123,11 +123,11 @@ class NewsletterPlugin::Newsletter < Noosfero::Plugin::ActiveRecord @@ -123,11 +123,11 @@ class NewsletterPlugin::Newsletter < Noosfero::Plugin::ActiveRecord
123 end 123 end
124 124
125 def post_with_image(post) 125 def post_with_image(post)
126 - content_tag(:tr,content_tag(:td,tag(:img, :src => "#{self.environment.top_url}#{post.image.public_filename(:big)}", :id => post.id),:style => CSS['post-image'])+content_tag(:td,content_tag(:span, show_date(post.published_at), :style => CSS['post-date'])+content_tag(:h3, link_to(h(post.title), post.url, :style => CSS['post-title']))+content_tag(:p,sanitize(post.lead(190)),:style => CSS['post-lead'])+read_more(post.url), :style => CSS['post-info'])) 126 + content_tag(:tr,content_tag(:td,tag(:img, :src => "#{self.environment.top_url}#{post.image.public_filename(:big)}", :id => post.id),:style => CSS['post-image'])+content_tag(:td,content_tag(:span, show_date(post.published_at), :style => CSS['post-date'])+content_tag(:h3, link_to(h(post.title), post.url, :style => CSS['post-title']))+content_tag(:p,sanitize(post.lead(190), tags: %w(strong em b i)),:style => CSS['post-lead'])+read_more(post.url), :style => CSS['post-info']))
127 end 127 end
128 128
129 def post_without_image(post) 129 def post_without_image(post)
130 - content_tag(:tr, content_tag(:td,content_tag(:span, show_date(post.published_at),:style => CSS['post-date'], :id => post.id)+content_tag(:h3, link_to(h(post.title), post.url,:style => CSS['post-title']))+content_tag(:p,sanitize(post.lead(360)),:style => CSS['post-lead'])+read_more(post.url),:colspan => 2, :style => CSS['post-info'])) 130 + content_tag(:tr, content_tag(:td,content_tag(:span, show_date(post.published_at),:style => CSS['post-date'], :id => post.id)+content_tag(:h3, link_to(h(post.title), post.url,:style => CSS['post-title']))+content_tag(:p,sanitize(post.lead(360), tags: %w(strong em b i)),:style => CSS['post-lead'])+read_more(post.url),:colspan => 2, :style => CSS['post-info']))
131 end 131 end
132 132
133 def body(data = {}) 133 def body(data = {})
@@ -177,10 +177,6 @@ class NewsletterPlugin::Newsletter < Noosfero::Plugin::ActiveRecord @@ -177,10 +177,6 @@ class NewsletterPlugin::Newsletter < Noosfero::Plugin::ActiveRecord
177 last_mailing.nil? ? nil : last_mailing.created_at 177 last_mailing.nil? ? nil : last_mailing.created_at
178 end 178 end
179 179
180 - def sanitize(html)  
181 - html.gsub(/<\/?p>/, '')  
182 - end  
183 -  
184 def has_posts_in_the_period? 180 def has_posts_in_the_period?
185 ! self.posts.empty? 181 ! self.posts.empty?
186 end 182 end
plugins/newsletter/test/unit/newsletter_plugin_newsletter_test.rb
  Diff comments   View file @4075f24
@@ -351,15 +351,30 @@ EOS @@ -351,15 +351,30 @@ EOS
351 post = fast_create(TextArticle, :parent_id => blog.id, 351 post = fast_create(TextArticle, :parent_id => blog.id,
352 :name => 'the last news 1', 352 :name => 'the last news 1',
353 :profile_id => community.id, 353 :profile_id => community.id,
354 - :body => "<p>paragraph of news</p>") 354 + :body => '<p style="text-align: left;">paragraph of news</p>')
355 355
356 newsletter = NewsletterPlugin::Newsletter.create!( 356 newsletter = NewsletterPlugin::Newsletter.create!(
357 :environment => environment, 357 :environment => environment,
358 :blog_ids => [blog.id], 358 :blog_ids => [blog.id],
359 :person => fast_create(Person)) 359 :person => fast_create(Person))
360 360
361 - assert_match /<p>paragraph of news<\/p>/, post.body  
362 - assert_not_match /<p>paragraph of news<\/p>/, newsletter.body 361 + assert_match /<p style="text-align: left;">paragraph of news<\/p>/, post.body
  362 + assert_not_match /<p style="text-align: left;">paragraph of news<\/p>/, newsletter.body
  363 + end
  364 +
  365 + should 'only include text for posts in HTML generated content' do
  366 + environment = fast_create Environment
  367 + community = fast_create(Community, :environment_id => environment.id)
  368 + blog = fast_create(Blog, :profile_id => community.id)
  369 + post = fast_create(TextArticle, :profile_id => community.id, :parent_id => blog.id, :name => 'the last news', :abstract => 'A picture<img src="example.png"> is <em>worth</em> a thousand words. <hr><h1>The main goals of visualization</h1>')
  370 + newsletter = NewsletterPlugin::Newsletter.create!(
  371 + :environment => environment,
  372 + :blog_ids => [blog.id],
  373 + :person => fast_create(Person))
  374 +
  375 + assert_match /A picture<img src="example.png"> is <em>worth<\/em> a thousand words. <hr><h1>The main goals of visualization<\/h1>/, post.abstract
  376 + # Tags for text emphasis are whitelisted
  377 + assert_match /A picture is <em>worth<\/em> a thousand words. The main goals of visualization/, newsletter.body
363 end 378 end
364 379
365 should 'filter posts when listing posts for newsletter' do 380 should 'filter posts when listing posts for newsletter' do