diff options
| -rw-r--r-- | public/javascripts/application.js | 9 | ||||
| -rw-r--r-- | test/system/inline_autocomplete_test.rb | 13 |
2 files changed, 22 insertions, 0 deletions
diff --git a/public/javascripts/application.js b/public/javascripts/application.js index aa0c9ed0b..0467d97db 100644 --- a/public/javascripts/application.js +++ b/public/javascripts/application.js @@ -1,6 +1,12 @@ /* Redmine - project management software Copyright (C) 2006-2020 Jean-Philippe Lang */ +function sanitizeHTML(string) { + var temp = document.createElement('span'); + temp.textContent = string; + return temp.innerHTML; +} + function checkAll(id, checked) { $('#'+id).find('input[type=checkbox]:enabled').prop('checked', checked); } @@ -1161,6 +1167,9 @@ function inlineAutoComplete(element) { selectTemplate: function (issue) { return '#' + issue.original.id; }, + menuItemTemplate: function (issue) { + return sanitizeHTML(issue.original.label); + }, noMatchTemplate: function () { return '<span style:"visibility: hidden;"></span>'; } diff --git a/test/system/inline_autocomplete_test.rb b/test/system/inline_autocomplete_test.rb index f3c7daef6..b2f943d05 100644 --- a/test/system/inline_autocomplete_test.rb +++ b/test/system/inline_autocomplete_test.rb @@ -151,4 +151,17 @@ class InlineAutocompleteSystemTest < ApplicationSystemTestCase end assert_equal '[[Page_with_sections]] ', find('#issue_description').value end + + def test_inline_autocomplete_for_issues_should_escape_html_elements + issue = Issue.generate!(subject: 'This issue has a <select> element', project_id: 1, tracker_id: 1) + + log_user('jsmith', 'jsmith') + visit 'projects/1/issues/new' + + fill_in 'Description', :with => '#This' + + within('.tribute-container') do + assert page.has_text? "Bug ##{issue.id}: This issue has a <select> element" + end + end end |