Download as
Browse Code »

Commit d4026821b9f0dc949e010d995ace1a882daef45c

Authored by Victor Costa
1 parent 8596ca29
Exists in master and in 27 other branches 1.2+SPB2, 2_split_by_role, add_fields_in_api, api_fixies, api_pagination, api_private_token, api_tasks, article_hit_count, blog_page_bug, checkbox_to_user_can_edit_page, communities_ratings, communities_ratings_moderation, community_ratings_rebase, fix_cloned_article_parent, fix_gallery_image_url, fix_javascript_categories, fix_optional_fields, fix_suggest_article, fix_user_email_validation, highlight_block_fix, notification_plugin, notification_plugin_rebase, script_to_update, split_by_role, temp_ratings, tests, tests_fixies

rails3: fix escape of javascript

Showing 10 changed files with 9 additions and 18 deletions   Show diff stats
app/helpers/application_helper.rb
  Diff comments   View file @d402682
... ... @@ -589,7 +589,7 @@ module ApplicationHelper
589 589 extra_info = extra_info.nil? ? '' : content_tag( 'span', extra_info, :class => 'extra_info' )
590 590 links = links_for_balloon(profile)
591 591 content_tag('div', content_tag(tag,
592   - (environment.enabled?(:show_balloon_with_profile_links_when_clicked) ? link_to( content_tag( 'span', _('Profile links')), '#', :onclick => "toggleSubmenu(this, '#{profile.short_name}', #{j(links.to_json)}); return false", :class => "menu-submenu-trigger #{trigger_class}", :url => url) : "") +
  592 + (environment.enabled?(:show_balloon_with_profile_links_when_clicked) ? link_to( content_tag( 'span', _('Profile links')), '#', :onclick => "toggleSubmenu(this, '#{profile.short_name}', #{CGI::escapeHTML(links.to_json)}); return false", :class => "menu-submenu-trigger #{trigger_class}", :url => url) : "") +
593 593 link_to(
594 594 content_tag( 'span', profile_image( profile, size ), :class => 'profile-image' ) +
595 595 content_tag( 'span', h(name), :class => ( profile.class == Person ? 'fn' : 'org' ) ) +
... ...
app/views/profile/_comment.html.erb
  Diff comments   View file @d402682
... ... @@ -46,7 +46,7 @@
46 46  
47 47 <% if logged_in? && (user == profile || user == comment.author || user.has_permission?(:moderate_comments, profile)) %>
48 48 <% button_bar(:style => 'float: right; margin-top: 0px;') do %>
49   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.article-comment'", j(url_for(:profile => params[:profile], :action => :remove_comment, :comment_id => comment.id, :view => params[:view]).to_json), _('Are you sure you want to remove this comment and all its replies?').to_json], :class => 'button icon-button icon-delete') %>
  49 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".article-comment", url_for(:profile => params[:profile], :action => :remove_comment, :comment_id => comment.id, :view => params[:view]), _('Are you sure you want to remove this comment and all its replies?')], :class => 'button icon-button icon-delete') %>
50 50 <% end %>
51 51 <% end %>
52 52 <br style="clear: both;" />
... ...
app/views/profile/_create_article.html.erb
  Diff comments   View file @d402682
... ... @@ -15,7 +15,7 @@
15 15 <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p>
16 16 <div class='profile-wall-actions'>
17 17 <%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %>
18   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :only_hide => true, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %>
  18 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :only_hide => true, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
19 19 </div>
20 20 </div>
21 21  
... ...
app/views/profile/_default_activity.html.erb
  Diff comments   View file @d402682
... ... @@ -6,7 +6,7 @@
6 6 <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p>
7 7 <div class='profile-wall-actions'>
8 8 <%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %>
9   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), j(_('Are you sure you want to remove this activity and all its replies?').to_json)]) if logged_in? && current_person == @profile %>
  9 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
10 10 </div>
11 11 </div>
12 12  
... ...
app/views/profile/_leave_scrap.html.erb
  Diff comments   View file @d402682
... ... @@ -5,7 +5,7 @@
5 5 <p class='profile-activity-text'><%= link_to activity.user.name, activity.user.url %> <%= describe activity %></p>
6 6 <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p>
7 7 <div class='profile-wall-actions'>
8   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %>
  8 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
9 9 </div>
10 10 </div>
11 11  
... ...
app/views/profile/_profile_scrap.html.erb
  Diff comments   View file @d402682
... ... @@ -12,7 +12,7 @@
12 12 <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %>
13 13 </span>
14 14 <% end %>
15   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json), _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %>
  15 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]), _('Are you sure you want to remove this scrap and all its replies?')]) if logged_in? && user.can_control_scrap?(scrap) %>
16 16 </div>
17 17 </div>
18 18  
... ...
app/views/profile/_profile_scraps.html.erb
  Diff comments   View file @d402682
... ... @@ -12,7 +12,7 @@
12 12 <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %>
13 13 </span>
14 14 <% end %>
15   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json), _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %>
  15 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]), _('Are you sure you want to remove this scrap and all its replies?')]) if logged_in? && user.can_control_scrap?(scrap) %>
16 16 </div>
17 17 </div>
18 18  
... ...
app/views/profile/_upload_image.html.erb
  Diff comments   View file @d402682
... ... @@ -6,7 +6,7 @@
6 6 <p class='profile-activity-text'><%= link_to activity.user.name, activity.user.url %> <%= describe activity %></p>
7 7 <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p>
8 8 <div class='profile-wall-actions'>
9   - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %>
  9 + <%= link_to_function(_('Remove'), 'remove_item_wall(this, \'%s\', \'%s\', \'%s\'); return false ;' % [".profile-activity-item", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]), _('Are you sure you want to remove this activity and all its replies?')]) if logged_in? && current_person == @profile %>
10 10 </div>
11 11 </div>
12 12 </div>
... ...
app/views/profile/report_abuse.html.erb
  Diff comments   View file @d402682
... ... @@ -24,7 +24,7 @@
24 24 $('#report-abuse-submit-button').css('cursor', 'progress');
25 25 $.ajax({
26 26 type: 'POST',
27   - url: <%= j(url_for({:controller => 'profile', :action => 'register_report', :profile => profile.identifier}).to_json) %>,
  27 + url: <%= url_for({:controller => 'profile', :action => 'register_report', :profile => profile.identifier}) %>,
28 28 data: $(form).serialize(),
29 29 dataType: 'json',
30 30 success: function(data, status, ajax){
... ...
config/initializers/json_escape.rb
View file @8596ca2
... ... @@ -1,9 +0,0 @@
1   -class ActionView::Base
2   - def json_escape(s)
3   - #result = s.to_s.gsub('/', '\/')
4   - result = CGI::escapeHTML(s)
5   - s.html_safe? ? result.html_safe : result
6   - end
7   -
8   - alias j json_escape
9   -end