Download as
Browse Code »

Commit 68833fe4dcbf02cddcef22e2cae774a36e327115

Authored by JoenioCosta
1 parent 224e08e5
Exists in master and in 29 other branches add_member_task_reject_details, admin_visible_profile, article-list-template, community_notifications, contact_admin_translation, event_fixes, fix_comments_pagination, fix_rails4_organization_ratings, fix_sign_up_form, follow_step_fix, forum_topic_creation, mirror_block_improvements, multi_env_on_remote_user, new_security, noosfero_spb_ci, organization_ratings_improvements, organization_ratings_link_to_profile_stable-spb-1.3, organization_ratings_translations_fix, profile_api_improvements, ratings_minor_fixes, remote_user_fix, send_email_to_admins, stable-spb-1.3, stable-spb-1.3-fixes, stable-spb-1.4, stable-spb-1.5, suggest_rejected_value, web_steps_improvements, xss_terminate_custom_options

ActionItem192: added before_filter to sanitize user input 

git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1673 3f533792-8f58-4932-b0fe-aaf55b0a4547
Showing 3 changed files with 28 additions and 0 deletions   Show diff stats
app/controllers/application.rb
  Diff comments   View file @68833fe
... ... @@ -40,6 +40,9 @@ class ApplicationController < ActionController::Base
40 40 verify :method => :post, :only => actions, :redirect_to => redirect
41 41 end
42 42  
  43 + # to sanitize params[...] add method sanitize to controller
  44 + before_filter :sanitize
  45 +
43 46 protected
44 47  
45 48 # TODO: move this logic somewhere else (Domain class?)
... ... @@ -112,5 +115,10 @@ class ApplicationController < ActionController::Base
112 115 end
113 116 end
114 117  
  118 + private
  119 +
  120 + def sanitize
  121 + # dont sanitize anything for default
  122 + end
115 123  
116 124 end
... ...
app/controllers/public/content_viewer_controller.rb
  Diff comments   View file @68833fe
... ... @@ -67,4 +67,16 @@ class ContentViewerController < PublicController
67 67 redirect_to :action => 'view_page'
68 68 end
69 69  
  70 + private
  71 +
  72 + include ERB::Util
  73 +
  74 + def sanitize
  75 + if params[:comment]
  76 + if params[:comment][:body]
  77 + params[:comment][:body] = html_escape(params[:comment][:body])
  78 + end
  79 + end
  80 + end
  81 +
70 82 end
... ...
test/functional/content_viewer_controller_test.rb
  Diff comments   View file @68833fe
... ... @@ -187,4 +187,12 @@ class ContentViewerControllerTest < Test::Unit::TestCase
187 187 assert_tag :tag => 'div', :attributes => { :class => 'post_comment_box opened' }
188 188 end
189 189  
  190 + should 'filter html content from body' do
  191 + login_as @profile.identifier
  192 + page = profile.articles.create!(:name => 'myarticle', :body => 'the body of the text')
  193 + post :view_page, :profile => @profile.identifier, :page => [ 'myarticle' ],
  194 + :comment => { :title => 'html comment', :body => "this is a <strong id='html_test_comment'>html comment</strong>" }
  195 + assert_no_tag :tag => 'strong', :attributes => { :id => 'html_test_comment' }
  196 + end
  197 +
190 198 end
... ...