diff options
| author | James Moger <james.moger@gitblit.com> | 2014-09-06 13:14:38 -0400 |
|---|---|---|
| committer | James Moger <james.moger@gitblit.com> | 2014-09-07 11:43:40 -0400 |
| commit | 209dbdd49a89d6e3cebf61e860c779a1d8561dd9 (patch) | |
| tree | 30eeadea1f31fff55fcd21965bfd843a45e94608 /src/main/java/com/gitblit/wicket/panels/CommentPanel.java | |
| parent | dfaf1fc1f6d8214bcabb9a613d53d0f0dc45352c (diff) | |
| download | gitblit-209dbdd49a89d6e3cebf61e860c779a1d8561dd9.tar.gz gitblit-209dbdd49a89d6e3cebf61e860c779a1d8561dd9.zip | |
Implement a SafeTextModel and use that for fields vulnerable to XSS
Diffstat (limited to 'src/main/java/com/gitblit/wicket/panels/CommentPanel.java')
| -rw-r--r-- | src/main/java/com/gitblit/wicket/panels/CommentPanel.java | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/main/java/com/gitblit/wicket/panels/CommentPanel.java b/src/main/java/com/gitblit/wicket/panels/CommentPanel.java index 1d49ff0f..130e7336 100644 --- a/src/main/java/com/gitblit/wicket/panels/CommentPanel.java +++ b/src/main/java/com/gitblit/wicket/panels/CommentPanel.java @@ -19,13 +19,14 @@ import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.ajax.markup.html.form.AjaxButton; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.html.form.Form; -import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import com.gitblit.models.RepositoryModel; import com.gitblit.models.TicketModel; import com.gitblit.models.TicketModel.Change; import com.gitblit.models.UserModel; +import com.gitblit.wicket.SafeTextModel; +import com.gitblit.wicket.SafeTextModel.Mode; import com.gitblit.wicket.WicketUtils; import com.gitblit.wicket.pages.BasePage; @@ -89,7 +90,7 @@ public class CommentPanel extends BasePanel { } }.setVisible(ticket != null && ticket.number > 0)); - final IModel<String> markdownPreviewModel = new Model<String>(); + final SafeTextModel markdownPreviewModel = new SafeTextModel(Mode.none); markdownPreview = new Label("markdownPreview", markdownPreviewModel); markdownPreview.setEscapeModelStrings(false); markdownPreview.setOutputMarkupId(true); |