Download as
Browse Code »

Commit c356065816ae96a4817b247fb4cfa217513ddfd0

Authored by Antonio Terceiro
1 parent b59e4735
Exists in master and in 29 other branches add_member_task_reject_details, admin_visible_profile, article-list-template, community_notifications, contact_admin_translation, event_fixes, fix_comments_pagination, fix_rails4_organization_ratings, fix_sign_up_form, follow_step_fix, forum_topic_creation, mirror_block_improvements, multi_env_on_remote_user, new_security, noosfero_spb_ci, organization_ratings_improvements, organization_ratings_link_to_profile_stable-spb-1.3, organization_ratings_translations_fix, profile_api_improvements, ratings_minor_fixes, remote_user_fix, send_email_to_admins, stable-spb-1.3, stable-spb-1.3-fixes, stable-spb-1.4, stable-spb-1.5, suggest_rejected_value, web_steps_improvements, xss_terminate_custom_options

Escape possible HTML content in a lot of places 

(ActionItem1476)
Showing 9 changed files with 11 additions and 11 deletions   Show diff stats
app/helpers/application_helper.rb
  Diff comments   View file @c356065
@@ -459,7 +459,7 @@ module ApplicationHelper @@ -459,7 +459,7 @@ module ApplicationHelper
459 # #profile_image) or only its name below. 459 # #profile_image) or only its name below.
460 def profile_add_link( profile, image=false, size=:portrait, tag='li') 460 def profile_add_link( profile, image=false, size=:portrait, tag='li')
461 the_class = profile.members.include?(user) ? 'profile_member' : '' 461 the_class = profile.members.include?(user) ? 'profile_member' : ''
462 - name = profile.short_name 462 + name = h(profile.short_name)
463 if image 463 if image
464 display = content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) + 464 display = content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) +
465 content_tag( 'span', name, :class => 'org' ) + 465 content_tag( 'span', name, :class => 'org' ) +
@@ -492,7 +492,7 @@ module ApplicationHelper @@ -492,7 +492,7 @@ module ApplicationHelper
492 content_tag tag, 492 content_tag tag,
493 link_to( 493 link_to(
494 content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) + 494 content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) +
495 - content_tag( 'span', name, :class => ( profile.class == Person ? 'fn' : 'org' ) ) + 495 + content_tag( 'span', h(name), :class => ( profile.class == Person ? 'fn' : 'org' ) ) +
496 city + profile_sex_icon( profile ) + profile_cat_icons( profile ), 496 city + profile_sex_icon( profile ) + profile_cat_icons( profile ),
497 profile.url, 497 profile.url,
498 :onclick => 'document.location.href = this.href', # work-arround for ie. 498 :onclick => 'document.location.href = this.href', # work-arround for ie.
@@ -505,7 +505,7 @@ module ApplicationHelper @@ -505,7 +505,7 @@ module ApplicationHelper
505 # displays a link to the community homepage with its image (as generated by 505 # displays a link to the community homepage with its image (as generated by
506 # #profile_image) and its name and number of members beside it. 506 # #profile_image) and its name and number of members beside it.
507 def community_image_link( profile, size=:portrait, tag='li' ) 507 def community_image_link( profile, size=:portrait, tag='li' )
508 - name = profile.name 508 + name = h(profile.name)
509 content_tag tag, 509 content_tag tag,
510 link_to( 510 link_to(
511 content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) + 511 content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) +
app/helpers/content_viewer_helper.rb
  Diff comments   View file @c356065
@@ -14,7 +14,7 @@ module ContentViewerHelper @@ -14,7 +14,7 @@ module ContentViewerHelper
14 def article_title(article, args = {}) 14 def article_title(article, args = {})
15 title = article.display_title if article.kind_of?(UploadedFile) && article.image? 15 title = article.display_title if article.kind_of?(UploadedFile) && article.image?
16 title = article.title if title.blank? 16 title = article.title if title.blank?
17 - title = content_tag('h1', title, :class => 'title') 17 + title = content_tag('h1', h(title), :class => 'title')
18 if article.belongs_to_blog? 18 if article.belongs_to_blog?
19 unless args[:no_link] 19 unless args[:no_link]
20 title = content_tag('h1', link_to(article.name, article.url), :class => 'title') 20 title = content_tag('h1', link_to(article.name, article.url), :class => 'title')
app/helpers/tags_helper.rb
  Diff comments   View file @c356065
@@ -57,7 +57,7 @@ module TagsHelper @@ -57,7 +57,7 @@ module TagsHelper
57 display_count = options[:show_count] ? "<small><sup>(#{count})</sup></small>" : "" 57 display_count = options[:show_count] ? "<small><sup>(#{count})</sup></small>" : ""
58 link_to tag + display_count, destination, :style => style 58 link_to tag + display_count, destination, :style => style
59 else 59 else
60 - link_to tag , destination, :style => style, 60 + link_to h(tag) , destination, :style => style,
61 :title => n_( 'one item', '%d items', count ) % count 61 :title => n_( 'one item', '%d items', count ) % count
62 end 62 end
63 63
app/views/blocks/profile_image.rhtml
  Diff comments   View file @c356065
@@ -11,7 +11,7 @@ @@ -11,7 +11,7 @@
11 </div> 11 </div>
12 12
13 <% if show_name %> 13 <% if show_name %>
14 - <p><%= block.owner.short_name %></p> 14 + <p><%= h block.owner.short_name %></p>
15 <% end %> 15 <% end %>
16 16
17 <% if !user.nil? and user.has_permission?('edit_profile', profile) %> 17 <% if !user.nil? and user.has_permission?('edit_profile', profile) %>
app/views/blocks/profile_info.rhtml
  Diff comments   View file @c356065
1 <div class="vcard"> 1 <div class="vcard">
2 2
3 -<h2 class="<%= profile.class == Person ? 'fn' : 'org' %>"><%= block.owner.short_name %></h2> 3 +<h2 class="<%= profile.class == Person ? 'fn' : 'org' %>"><%= h block.owner.short_name %></h2>
4 4
5 <div class="profile-info-picture"> 5 <div class="profile-info-picture">
6 <div class="profile-info-picture-inner1"> 6 <div class="profile-info-picture-inner1">
app/views/layouts/application-ng.rhtml
  Diff comments   View file @c356065
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<%= html_language %>" lang="<%= html_language %>"> 2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<%= html_language %>" lang="<%= html_language %>">
3 <head> 3 <head>
4 - <title><%= page_title %></title> 4 + <title><%= h page_title %></title>
5 <%= meta_tags_for_article(@page) %> 5 <%= meta_tags_for_article(@page) %>
6 <!--<meta http-equiv="refresh" content="1"/>--> 6 <!--<meta http-equiv="refresh" content="1"/>-->
7 <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> 7 <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
app/views/layouts/application.rhtml
  Diff comments   View file @c356065
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<%= html_language %>" lang="<%= html_language %>"> 2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<%= html_language %>" lang="<%= html_language %>">
3 <head> 3 <head>
4 - <title><%= page_title %></title> 4 + <title><%= h page_title %></title>
5 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 5 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
6 <meta name="description" content="<%= @environment.name %>" /> 6 <meta name="description" content="<%= @environment.name %>" />
7 <meta name="keywords" content="Noosfero, Community, Open Source" /> 7 <meta name="keywords" content="Noosfero, Community, Open Source" />
app/views/profile/index.rhtml
  Diff comments   View file @c356065
1 <%= render :partial => 'shared/disabled_enterprise' %> 1 <%= render :partial => 'shared/disabled_enterprise' %>
2 2
3 -<h1><%= profile.name %></h1> 3 +<h1><%= h profile.name %></h1>
4 4
5 <% if @action %> 5 <% if @action %>
6 <%= render :partial => 'private_profile' %> 6 <%= render :partial => 'private_profile' %>
app/views/profile_editor/index.rhtml
  Diff comments   View file @c356065
1 <div id="profile-editor-index"> 1 <div id="profile-editor-index">
2 2
3 <h1 class="block-title"> 3 <h1 class="block-title">
4 - <span class='control-panel-title'><%= profile.short_name %></span> 4 + <span class='control-panel-title'><%= h profile.short_name %></span>
5 <span class='control-panel-sep'>&#150;</span> 5 <span class='control-panel-sep'>&#150;</span>
6 <span class='control-panel-subtitle'><%= _('Control Panel') %></span> 6 <span class='control-panel-subtitle'><%= _('Control Panel') %></span>
7 </h1> 7 </h1>