jro_apps/redmine Commit - r2142:4ec5b1600a9e

Escape double-quotes in image titles....

Jean-Philippe Lang -

r2142:4ec5b1600a9e

parent child

Context file:

r2142:4ec5b1600a9e

lib/redcloth3.rb +5 -1

                 #
                 # Flexible HTML escaping
                 #
-                def htmlesc( str, mode )
+                def htmlesc( str, mode=:Quotes )
+                  if str
                     str.gsub!( '&', '&amp;' )
                     str.gsub!( '"', '&quot;' ) if mode != :NoQuotes
                     str.gsub!( "'", '&#039;' ) if mode == :Quotes
                     str.gsub!( '<', '&lt;')
                     str.gsub!( '>', '&gt;')
+                  end
+                  str
                 end
                 # Search and replace for Textile glyphs (quotes, dashes, other symbols)
                 def inline_textile_image( text )
                     text.gsub!( IMAGE_RE )  do |m|
                         stln,algn,atts,url,title,href,href_a1,href_a2 = $~[1..8]
+                        htmlesc title
                         atts = pba( atts )
                         atts = " src=\"#{ url }\"#{ atts }"
                         atts << " title=\"#{ title }\"" if title

test/unit/helpers/application_helper_test.rb +2 0

                   'floating !>http://foo.bar/image.jpg!' => 'floating <div style="float:right"><img src="http://foo.bar/image.jpg" alt="" /></div>',
                   'with class !(some-class)http://foo.bar/image.jpg!' => 'with class <img src="http://foo.bar/image.jpg" class="some-class" alt="" />',
                   'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" style="width:100px;height100px;" alt="" />',
+                  'with title !http://foo.bar/image.jpg(This is a title)!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a title" alt="This is a title" />',
+                  'with title !http://foo.bar/image.jpg(This is a double-quoted "title")!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a double-quoted &quot;title&quot;" alt="This is a double-quoted &quot;title&quot;" />',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages