Download as
Browse Code »

Commit f071768dab0c3c993d4970145278035effe20ae3

Authored by JoenioCosta
1 parent f26b098c
Exists in master and in 29 other branches add_member_task_reject_details, admin_visible_profile, article-list-template, community_notifications, contact_admin_translation, event_fixes, fix_comments_pagination, fix_rails4_organization_ratings, fix_sign_up_form, follow_step_fix, forum_topic_creation, mirror_block_improvements, multi_env_on_remote_user, new_security, noosfero_spb_ci, organization_ratings_improvements, organization_ratings_link_to_profile_stable-spb-1.3, organization_ratings_translations_fix, profile_api_improvements, ratings_minor_fixes, remote_user_fix, send_email_to_admins, stable-spb-1.3, stable-spb-1.3-fixes, stable-spb-1.4, stable-spb-1.5, suggest_rejected_value, web_steps_improvements, xss_terminate_custom_options

ActionItem192: sanitizing fields from admin_panel_controller 

git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1727 3f533792-8f58-4932-b0fe-aaf55b0a4547
Showing 2 changed files with 8 additions and 0 deletions   Show diff stats
app/models/environment.rb
  Diff comments   View file @f071768
... ... @@ -185,6 +185,8 @@ class Environment < ActiveRecord::Base
185 185  
186 186 validates_format_of :contact_email, :with => Noosfero::Constants::EMAIL_FORMAT, :if => (lambda { |record| ! record.contact_email.blank? })
187 187  
  188 + xss_terminate :only => [ :description ]
  189 +
188 190 # #################################################
189 191 # Business logic in general
190 192 # #################################################
... ...
test/functional/admin_panel_controller_test.rb
  Diff comments   View file @f071768
... ... @@ -66,4 +66,10 @@ class AdminPanelControllerTest < Test::Unit::TestCase
66 66 assert_equal "This is my new environment", Environment.default.description
67 67 end
68 68  
  69 + should 'sanitize description' do
  70 + post :site_info, :environment => { :description => "This <strong>is</strong> my new environment" }
  71 + assert_redirected_to :action => 'index'
  72 + assert_sanitized Environment.default.description
  73 + end
  74 +
69 75 end
... ...