From d4026821b9f0dc949e010d995ace1a882daef45c Mon Sep 17 00:00:00 2001 From: Victor Costa Date: Tue, 13 May 2014 13:18:43 -0300 Subject: [PATCH] rails3: fix escape of javascript --- app/helpers/application_helper.rb | 2 +- app/views/profile/_comment.html.erb | 2 +- app/views/profile/_create_article.html.erb | 2 +- app/views/profile/_default_activity.html.erb | 2 +- app/views/profile/_leave_scrap.html.erb | 2 +- app/views/profile/_profile_scrap.html.erb | 2 +- app/views/profile/_profile_scraps.html.erb | 2 +- app/views/profile/_upload_image.html.erb | 2 +- app/views/profile/report_abuse.html.erb | 2 +- config/initializers/json_escape.rb | 9 --------- 10 files changed, 9 insertions(+), 18 deletions(-) delete mode 100644 config/initializers/json_escape.rb diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 964aaa4..4df9747 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -589,7 +589,7 @@ module ApplicationHelper extra_info = extra_info.nil? ? '' : content_tag( 'span', extra_info, :class => 'extra_info' ) links = links_for_balloon(profile) content_tag('div', content_tag(tag, - (environment.enabled?(:show_balloon_with_profile_links_when_clicked) ? link_to( content_tag( 'span', _('Profile links')), '#', :onclick => "toggleSubmenu(this, '#{profile.short_name}', #{j(links.to_json)}); return false", :class => "menu-submenu-trigger #{trigger_class}", :url => url) : "") + + (environment.enabled?(:show_balloon_with_profile_links_when_clicked) ? link_to( content_tag( 'span', _('Profile links')), '#', :onclick => "toggleSubmenu(this, '#{profile.short_name}', #{CGI::escapeHTML(links.to_json)}); return false", :class => "menu-submenu-trigger #{trigger_class}", :url => url) : "") + link_to( content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) + content_tag( 'span', h(name), :class => ( profile.class == Person ? 'fn' : 'org' ) ) + diff --git a/app/views/profile/_comment.html.erb b/app/views/profile/_comment.html.erb index cb0afee..e034399 100644 --- a/app/views/profile/_comment.html.erb +++ b/app/views/profile/_comment.html.erb @@ -46,7 +46,7 @@ <% if logged_in? && (user == profile || user == comment.author || user.has_permission?(:moderate_comments, profile)) %> <% button_bar(:style => 'float: right; margin-top: 0px;') do %> - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.article-comment'", j(url_for(:profile => params[:profile], :action => :remove_comment, :comment_id => comment.id, :view => params[:view]).to_json), _('Are you sure you want to remove this comment and all its replies?').to_json], :class => 'button icon-button icon-delete') %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".article-comment", url_for(:profile => params[:profile], :action => :remove_comment, :comment_id => comment.id, :view => params[:view]), _('Are you sure you want to remove this comment and all its replies?')], :class => 'button icon-button icon-delete') %> <% end %> <% end %>
diff --git a/app/views/profile/_create_article.html.erb b/app/views/profile/_create_article.html.erb index 5555052..8385a5d 100644 --- a/app/views/profile/_create_article.html.erb +++ b/app/views/profile/_create_article.html.erb @@ -15,7 +15,7 @@

<%= time_ago_as_sentence(activity.created_at) %>

<%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %> - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :only_hide => true, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :only_hide => true, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
diff --git a/app/views/profile/_default_activity.html.erb b/app/views/profile/_default_activity.html.erb index fb2e133..6a9d342 100644 --- a/app/views/profile/_default_activity.html.erb +++ b/app/views/profile/_default_activity.html.erb @@ -6,7 +6,7 @@

<%= time_ago_as_sentence(activity.created_at) %>

<%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %> - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), j(_('Are you sure you want to remove this activity and all its replies?').to_json)]) if logged_in? && current_person == @profile %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
diff --git a/app/views/profile/_leave_scrap.html.erb b/app/views/profile/_leave_scrap.html.erb index 4e6a365..8ef4313 100644 --- a/app/views/profile/_leave_scrap.html.erb +++ b/app/views/profile/_leave_scrap.html.erb @@ -5,7 +5,7 @@

<%= link_to activity.user.name, activity.user.url %> <%= describe activity %>

<%= time_ago_as_sentence(activity.created_at) %>

- <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
diff --git a/app/views/profile/_profile_scrap.html.erb b/app/views/profile/_profile_scrap.html.erb index f26d0c2..baf0459 100644 --- a/app/views/profile/_profile_scrap.html.erb +++ b/app/views/profile/_profile_scrap.html.erb @@ -12,7 +12,7 @@ <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %> <% end %> - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json), _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]), _('Are you sure you want to remove this scrap and all its replies?')]) if logged_in? && user.can_control_scrap?(scrap) %> diff --git a/app/views/profile/_profile_scraps.html.erb b/app/views/profile/_profile_scraps.html.erb index 88b094c..fc29559 100644 --- a/app/views/profile/_profile_scraps.html.erb +++ b/app/views/profile/_profile_scraps.html.erb @@ -12,7 +12,7 @@ <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %> <% end %> - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json), _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]), _('Are you sure you want to remove this scrap and all its replies?')]) if logged_in? && user.can_control_scrap?(scrap) %> diff --git a/app/views/profile/_upload_image.html.erb b/app/views/profile/_upload_image.html.erb index e17ed18..444e4ba 100644 --- a/app/views/profile/_upload_image.html.erb +++ b/app/views/profile/_upload_image.html.erb @@ -6,7 +6,7 @@

<%= link_to activity.user.name, activity.user.url %> <%= describe activity %>

<%= time_ago_as_sentence(activity.created_at) %>

- <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
diff --git a/app/views/profile/report_abuse.html.erb b/app/views/profile/report_abuse.html.erb index 24f1694..1c44ccb 100644 --- a/app/views/profile/report_abuse.html.erb +++ b/app/views/profile/report_abuse.html.erb @@ -24,7 +24,7 @@ $('#report-abuse-submit-button').css('cursor', 'progress'); $.ajax({ type: 'POST', - url: <%= j(url_for({:controller => 'profile', :action => 'register_report', :profile => profile.identifier}).to_json) %>, + url: <%= url_for({:controller => 'profile', :action => 'register_report', :profile => profile.identifier}) %>, data: $(form).serialize(), dataType: 'json', success: function(data, status, ajax){ diff --git a/config/initializers/json_escape.rb b/config/initializers/json_escape.rb deleted file mode 100644 index a9000ef..0000000 --- a/config/initializers/json_escape.rb +++ /dev/null @@ -1,9 +0,0 @@ -class ActionView::Base - def json_escape(s) - #result = s.to_s.gsub('/', '\/') - result = CGI::escapeHTML(s) - s.html_safe? ? result.html_safe : result - end - - alias j json_escape -end -- libgit2 0.21.2