diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2006-12-17 08:10:18 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2006-12-17 08:10:18 +0000 |
| commit | 2b86ef8e28d0e5376197391c29a8fb302f14820f (patch) | |
| tree | e5a80fb24158b350507c28021418a19aa7084991 /app/helpers | |
| parent | 3e28dc669b014db811c0de673a090adf54f42bc1 (diff) | |
| download | redmine-2b86ef8e28d0e5376197391c29a8fb302f14820f.tar.gz redmine-2b86ef8e28d0e5376197391c29a8fb302f14820f.zip | |
various modifications to prevent xss
- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding
git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/helpers')
| -rw-r--r-- | app/helpers/issues_helper.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/app/helpers/issues_helper.rb b/app/helpers/issues_helper.rb index 93bd6c050..d73258939 100644 --- a/app/helpers/issues_helper.rb +++ b/app/helpers/issues_helper.rb @@ -56,9 +56,9 @@ module IssuesHelper unless no_html
label = content_tag('strong', label)
- old_value = content_tag("i", old_value) if old_value
- old_value = content_tag("strike", old_value) if old_value and !value
- value = content_tag("i", value) if value
+ old_value = content_tag("i", h(old_value)) if old_value
+ old_value = content_tag("strike", h(old_value)) if old_value and !value
+ value = content_tag("i", h(value)) if value
end
if value
|