Commit 605725ff76305f9abf1ccebe091489f25409591b
1 parent
6672bb97
Exists in
new_security
Fixing tests
4 failures, 0 errors Signed-off-by: Alexandre Barbosa <alexandreab@live.com> Signed-off-by: Arthur Jahn <stutrzbecher@gmail.com> Signed-off-by: David Carlos <ddavidcarlos1392@gmail.com>
Showing
8 changed files
with
12 additions
and
12 deletions
Show diff stats
app/helpers/application_helper.rb
@@ -567,15 +567,15 @@ module ApplicationHelper | @@ -567,15 +567,15 @@ module ApplicationHelper | ||
567 | links = links_for_balloon(profile) | 567 | links = links_for_balloon(profile) |
568 | content_tag('div', content_tag(tag, | 568 | content_tag('div', content_tag(tag, |
569 | (environment.enabled?(:show_balloon_with_profile_links_when_clicked) ? | 569 | (environment.enabled?(:show_balloon_with_profile_links_when_clicked) ? |
570 | - popover_menu(_('Profile links'),profile.short_name,links,{:class => trigger_class, :url => url}) : "") + | 570 | + popover_menu(_('Profile links'),profile.short_name,links,{:class => trigger_class, :url => url}) : "").html_safe + |
571 | link_to( | 571 | link_to( |
572 | content_tag( 'span', profile_image( profile, size ), :class => img_class ) + | 572 | content_tag( 'span', profile_image( profile, size ), :class => img_class ) + |
573 | content_tag( 'span', h(name), :class => ( profile.class == Person ? 'fn' : 'org' ) ) + | 573 | content_tag( 'span', h(name), :class => ( profile.class == Person ? 'fn' : 'org' ) ) + |
574 | extra_info_tag + profile_sex_icon( profile ), | 574 | extra_info_tag + profile_sex_icon( profile ), |
575 | - profile.url, | 575 | + url, |
576 | :class => 'profile_link url', | 576 | :class => 'profile_link url', |
577 | :help => _('Click on this icon to go to the <b>%s</b>\'s home page') % profile.name, | 577 | :help => _('Click on this icon to go to the <b>%s</b>\'s home page') % profile.name, |
578 | - :title => profile.name ), | 578 | + :title => profile.name ).html_safe, |
579 | :class => 'vcard'), :class => 'common-profile-list-block') | 579 | :class => 'vcard'), :class => 'common-profile-list-block') |
580 | end | 580 | end |
581 | 581 | ||
@@ -835,7 +835,7 @@ module ApplicationHelper | @@ -835,7 +835,7 @@ module ApplicationHelper | ||
835 | end | 835 | end |
836 | else | 836 | else |
837 | if profile.active_fields.include?(name) | 837 | if profile.active_fields.include?(name) |
838 | - result = content_tag('div', field_html + profile_field_privacy_selector(profile, name), :class => 'field-with-privacy-selector-R1') | 838 | + result = content_tag('div', field_html + profile_field_privacy_selector(profile, name), :class => 'field-with-privacy-selector') |
839 | end | 839 | end |
840 | end | 840 | end |
841 | 841 | ||
@@ -1392,7 +1392,7 @@ module ApplicationHelper | @@ -1392,7 +1392,7 @@ module ApplicationHelper | ||
1392 | html = @plugins.pipeline(:parse_content, html, source).first | 1392 | html = @plugins.pipeline(:parse_content, html, source).first |
1393 | end | 1393 | end |
1394 | 1394 | ||
1395 | - html.html_safe && html | 1395 | + html && html.html_safe |
1396 | end | 1396 | end |
1397 | 1397 | ||
1398 | def convert_macro(html, source) | 1398 | def convert_macro(html, source) |
app/helpers/box_organizer_helper.rb
@@ -38,7 +38,7 @@ module BoxOrganizerHelper | @@ -38,7 +38,7 @@ module BoxOrganizerHelper | ||
38 | content_tag(:ul, | 38 | content_tag(:ul, |
39 | images_path.map do |preview| | 39 | images_path.map do |preview| |
40 | content_tag(:li, image_tag(preview, height: '240', alt: '')) | 40 | content_tag(:li, image_tag(preview, height: '240', alt: '')) |
41 | - end.join("\n") | 41 | + end.join("\n").html_safe |
42 | ) | 42 | ) |
43 | end | 43 | end |
44 | 44 |
app/helpers/boxes_helper.rb
@@ -282,7 +282,7 @@ module BoxesHelper | @@ -282,7 +282,7 @@ module BoxesHelper | ||
282 | buttons << modal_inline_icon(:embed, _('Embed code'), {}, "#embed-code-box-#{block.id}") << html | 282 | buttons << modal_inline_icon(:embed, _('Embed code'), {}, "#embed-code-box-#{block.id}") << html |
283 | end | 283 | end |
284 | 284 | ||
285 | - content_tag('div', buttons.join("\n") + tag('br', :style => 'clear: left'), :class => 'button-bar') | 285 | + content_tag('div', buttons.join("\n").html_safe + tag('br', :style => 'clear: left'), :class => 'button-bar') |
286 | end | 286 | end |
287 | 287 | ||
288 | def current_blocks | 288 | def current_blocks |
app/helpers/language_helper.rb
@@ -40,7 +40,7 @@ module LanguageHelper | @@ -40,7 +40,7 @@ module LanguageHelper | ||
40 | else | 40 | else |
41 | link_to(name, params.merge(:lang => code), :rel => 'nofollow') | 41 | link_to(name, params.merge(:lang => code), :rel => 'nofollow') |
42 | end | 42 | end |
43 | - end.join(separator) | 43 | + end.join(separator).html_safe |
44 | content_tag('div', languages, :id => 'language-chooser', :help => _('The language you choose here is the language used for options, buttons, etc. It does not affect the language of the content created by other users.')) | 44 | content_tag('div', languages, :id => 'language-chooser', :help => _('The language you choose here is the language used for options, buttons, etc. It does not affect the language of the content created by other users.')) |
45 | end | 45 | end |
46 | end | 46 | end |
app/models/blog_archives_block.rb
@@ -36,7 +36,7 @@ class BlogArchivesBlock < Block | @@ -36,7 +36,7 @@ class BlogArchivesBlock < Block | ||
36 | results << content_tag('li', content_tag('strong', "#{year.to_i} (#{count})")) | 36 | results << content_tag('li', content_tag('strong', "#{year.to_i} (#{count})")) |
37 | results << "<ul class='#{year.to_i}-archive'>" | 37 | results << "<ul class='#{year.to_i}-archive'>" |
38 | posts.except(:order).where('EXTRACT(YEAR FROM published_at)=?', year.to_i).group('EXTRACT(MONTH FROM published_at)').count.sort_by {|month, count| -month.to_i}.each do |month, count| | 38 | posts.except(:order).where('EXTRACT(YEAR FROM published_at)=?', year.to_i).group('EXTRACT(MONTH FROM published_at)').count.sort_by {|month, count| -month.to_i}.each do |month, count| |
39 | - results << content_tag('li', link_to("#{month_name(month.to_i)} (#{count})", owner_blog.url.merge(year: year.to_i, month: month.to_i))) | 39 | + results << content_tag('li', link_to("#{month_name(month.to_i)} (#{count})", url_for(owner_blog.url.merge(year: year.to_i, month: month.to_i)).html_safe)) |
40 | end | 40 | end |
41 | results << "</ul>" | 41 | results << "</ul>" |
42 | end | 42 | end |
app/views/profile/index.html.erb
@@ -5,7 +5,7 @@ | @@ -5,7 +5,7 @@ | ||
5 | <% else %> | 5 | <% else %> |
6 | <% unless profile.description.blank? %> | 6 | <% unless profile.description.blank? %> |
7 | <div class='public-profile-description'> | 7 | <div class='public-profile-description'> |
8 | - <%= profile.description %> | 8 | + <%= raw profile.description %> |
9 | </div> | 9 | </div> |
10 | <% end %> | 10 | <% end %> |
11 | <div id='public-profile-search'> | 11 | <div id='public-profile-search'> |
app/views/profile_editor/_organization.html.erb
@@ -41,7 +41,7 @@ | @@ -41,7 +41,7 @@ | ||
41 | <div id="profile-identifier-formitem"> | 41 | <div id="profile-identifier-formitem"> |
42 | <%= required labelled_form_field( _('Address'), | 42 | <%= required labelled_form_field( _('Address'), |
43 | content_tag('code', | 43 | content_tag('code', |
44 | - url_for(profile.url).gsub(/#{profile.identifier}$/, '') + | 44 | + url_for(profile.url).gsub(/#{profile.identifier}$/, '').html_safe + |
45 | text_field(:profile_data, :identifier, :onchange => "warn_value_change()", :size => 25) | 45 | text_field(:profile_data, :identifier, :onchange => "warn_value_change()", :size => 25) |
46 | ) + | 46 | ) + |
47 | content_tag('div', | 47 | content_tag('div', |
test/functional/profile_controller_test.rb
@@ -512,7 +512,7 @@ class ProfileControllerTest < ActionController::TestCase | @@ -512,7 +512,7 @@ class ProfileControllerTest < ActionController::TestCase | ||
512 | should 'show description of orgarnization' do | 512 | should 'show description of orgarnization' do |
513 | login_as(@profile.identifier) | 513 | login_as(@profile.identifier) |
514 | ent = fast_create(Enterprise) | 514 | ent = fast_create(Enterprise) |
515 | - ent.description = 'Enterprise\'s description' | 515 | + ent.description = "<span>Enterprise's description</span>" |
516 | ent.save | 516 | ent.save |
517 | get :index, :profile => ent.identifier | 517 | get :index, :profile => ent.identifier |
518 | assert_tag :tag => 'div', :attributes => { :class => 'public-profile-description' }, :content => /Enterprise\'s description/ | 518 | assert_tag :tag => 'div', :attributes => { :class => 'public-profile-description' }, :content => /Enterprise\'s description/ |