git-svn-id: http://svn.redmine.org/redmine/branches/4.1-stable@20828 e93f8b46-1217-0410-a6f0-8f06a7374b81tags/4.1.2
@@ -8,6 +8,12 @@ $.ajaxPrefilter(function (s) { | |||
} | |||
}); | |||
function sanitizeHTML(string) { | |||
var temp = document.createElement('span'); | |||
temp.textContent = string; | |||
return temp.innerHTML; | |||
} | |||
function checkAll(id, checked) { | |||
$('#'+id).find('input[type=checkbox]:enabled').prop('checked', checked); | |||
} | |||
@@ -1062,6 +1068,9 @@ function inlineAutoComplete(element) { | |||
requireLeadingSpace: true, | |||
selectTemplate: function (issue) { | |||
return '#' + issue.original.id; | |||
}, | |||
menuItemTemplate: function (issue) { | |||
return sanitizeHTML(issue.original.label); | |||
} | |||
}); | |||
@@ -129,4 +129,17 @@ class InlineAutocompleteSystemTest < ApplicationSystemTestCase | |||
page.has_css?('.tribute-container li', minimum: 1) | |||
end | |||
def test_inline_autocomplete_for_issues_should_escape_html_elements | |||
issue = Issue.generate!(subject: 'This issue has a <select> element', project_id: 1, tracker_id: 1) | |||
log_user('jsmith', 'jsmith') | |||
visit 'projects/1/issues/new' | |||
fill_in 'Description', :with => '#This' | |||
within('.tribute-container') do | |||
assert page.has_text? "Bug ##{issue.id}: This issue has a <select> element" | |||
end | |||
end | |||
end |