From: Toshi MARUYAMA <marutosijp2@yahoo.co.jp>
Date: Tue, 2 Aug 2011 12:55:55 +0000 (+0000)
Subject: HTML escape at app/views/common/_diff.rhtml.
X-Git-Tag: 1.3.0~1583
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=f742cef0f15757b7ec3f0150dba2ae7040337f6d;p=redmine.git

HTML escape at app/views/common/_diff.rhtml.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6360 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/views/common/_diff.rhtml b/app/views/common/_diff.rhtml
index 03b06a0ce..9967a6810 100644
--- a/app/views/common/_diff.rhtml
+++ b/app/views/common/_diff.rhtml
@@ -5,7 +5,7 @@
 <% if diff.diff_type == 'sbs' -%>
 <table class="filecontent">
 <thead>
-<tr><th colspan="4" class="filename"><%=to_utf8 table_file.file_name %></th></tr>
+<tr><th colspan="4" class="filename"><%=h(to_utf8(table_file.file_name)) %></th></tr>
 </thead>
 <tbody>
 <% table_file.each_line do |spacing, line| -%>
@@ -31,7 +31,7 @@
 <% else -%>
 <table class="filecontent">
 <thead>
-<tr><th colspan="3" class="filename"><%=to_utf8 table_file.file_name %></th></tr>
+<tr><th colspan="3" class="filename"><%=h(to_utf8(table_file.file_name)) %></th></tr>
 </thead>
 <tbody>
 <% table_file.each_line do |spacing, line| %>