diff options
| author | Marius Balteanu <marius.balteanu@zitec.com> | 2022-09-27 17:11:53 +0000 |
|---|---|---|
| committer | Marius Balteanu <marius.balteanu@zitec.com> | 2022-09-27 17:11:53 +0000 |
| commit | 468377d6b54e9a29a9f1949b7c90df7f84ccb80a (patch) | |
| tree | ed09e613bcca547533d5abd73ac8d7811ec53086 /lib | |
| parent | 0224b79ccda081669145e8a92118e55632648771 (diff) | |
| download | redmine-468377d6b54e9a29a9f1949b7c90df7f84ccb80a.tar.gz redmine-468377d6b54e9a29a9f1949b7c90df7f84ccb80a.zip | |
Merged r21850 and r21851 from trunk to 5.0-stable (#37237).
git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21859 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb index 7fef35bfa..b1f1cfe01 100644 --- a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb +++ b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb @@ -27,6 +27,18 @@ module Redmine "a" => %w(href).freeze, }.freeze + ALLOWED_CSS_PROPERTIES = %w[ + color background-color + width + height + padding padding-left padding-right padding-top padding-bottom + margin margin-left margin-right margin-top margin-bottom + border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing + font font-style font-variant font-weight font-stretch font-size line-height font-family + text-align + float + ].freeze + def allowlist @allowlist ||= customize_allowlist(super.deep_dup) end @@ -40,6 +52,9 @@ module Redmine allowlist[:attributes][:all].delete("name") allowlist[:attributes]["a"].push("name") + allowlist[:attributes][:all].push("style") + allowlist[:css] = { properties: ALLOWED_CSS_PROPERTIES } + # allow class on code tags (this holds the language info from fenced # code bocks and has the format language-foo) allowlist[:attributes]["code"] = %w(class) |