##// END OF EJS Templates
jro_apps » redmine
RSS
xss in issue subject on issues/edit...
Jean-Philippe Lang -
r104:6c8e1514aa0c
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,49 +1,49
1 <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%= @issue.subject %></h2>
1 <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%=h @issue.subject %></h2>
2
2
3 <% labelled_tabular_form_for :issue, @issue, :url => {:action => 'edit'} do |f| %>
3 <% labelled_tabular_form_for :issue, @issue, :url => {:action => 'edit'} do |f| %>
4 <%= error_messages_for 'issue' %>
4 <%= error_messages_for 'issue' %>
5 <div class="box">
5 <div class="box">
6 <!--[form:issue]-->
6 <!--[form:issue]-->
7 <div class="splitcontentleft">
7 <div class="splitcontentleft">
8 <p><label><%=l(:field_status)%></label> <%= @issue.status.name %></p>
8 <p><label><%=l(:field_status)%></label> <%= @issue.status.name %></p>
9 <p><%= f.select :priority_id, (@priorities.collect {|p| [p.name, p.id]}), :required => true %></p>
9 <p><%= f.select :priority_id, (@priorities.collect {|p| [p.name, p.id]}), :required => true %></p>
10 <p><%= f.select :assigned_to_id, (@issue.project.members.collect {|m| [m.name, m.user_id]}), :include_blank => true %></p>
10 <p><%= f.select :assigned_to_id, (@issue.project.members.collect {|m| [m.name, m.user_id]}), :include_blank => true %></p>
11 <p><%= f.select :category_id, (@project.issue_categories.collect {|c| [c.name, c.id]}) %></p>
11 <p><%= f.select :category_id, (@project.issue_categories.collect {|c| [c.name, c.id]}) %></p>
12 </div>
12 </div>
13
13
14 <div class="splitcontentright">
14 <div class="splitcontentright">
15 <p><%= f.text_field :start_date, :size => 10 %><%= calendar_for('issue_start_date') %></p>
15 <p><%= f.text_field :start_date, :size => 10 %><%= calendar_for('issue_start_date') %></p>
16 <p><%= f.text_field :due_date, :size => 10 %><%= calendar_for('issue_due_date') %></p>
16 <p><%= f.text_field :due_date, :size => 10 %><%= calendar_for('issue_due_date') %></p>
17 <p><%= f.select :done_ratio, ((0..10).to_a.collect {|r| ["#{r*10} %", r*10] }) %></p>
17 <p><%= f.select :done_ratio, ((0..10).to_a.collect {|r| ["#{r*10} %", r*10] }) %></p>
18 </div>
18 </div>
19
19
20 <div class="clear">
20 <div class="clear">
21 <p><%= f.text_field :subject, :size => 80, :required => true %></p>
21 <p><%= f.text_field :subject, :size => 80, :required => true %></p>
22 <p><%= f.text_area :description, :cols => 60, :rows => [[10, @issue.description.length / 50].max, 100].min, :required => true %></p>
22 <p><%= f.text_area :description, :cols => 60, :rows => [[10, @issue.description.length / 50].max, 100].min, :required => true %></p>
23
23
24 <% for @custom_value in @custom_values %>
24 <% for @custom_value in @custom_values %>
25 <p><%= custom_field_tag_with_label @custom_value %></p>
25 <p><%= custom_field_tag_with_label @custom_value %></p>
26 <% end %>
26 <% end %>
27
27
28 <p><%= f.select :fixed_version_id, (@project.versions.collect {|v| [v.name, v.id]}), { :include_blank => true } %>
28 <p><%= f.select :fixed_version_id, (@project.versions.collect {|v| [v.name, v.id]}), { :include_blank => true } %>
29 </select></p>
29 </select></p>
30 </div>
30 </div>
31 <!--[eoform:issue]-->
31 <!--[eoform:issue]-->
32 </div>
32 </div>
33 <%= f.hidden_field :lock_version %>
33 <%= f.hidden_field :lock_version %>
34 <%= submit_tag l(:button_save) %>
34 <%= submit_tag l(:button_save) %>
35 <% end %>
35 <% end %>
36
36
37 <% unless $RDM_TEXTILE_DISABLED %>
37 <% unless $RDM_TEXTILE_DISABLED %>
38 <%= javascript_include_tag 'jstoolbar' %>
38 <%= javascript_include_tag 'jstoolbar' %>
39 <script type="text/javascript">
39 <script type="text/javascript">
40 //<![CDATA[
40 //<![CDATA[
41 if (document.getElementById) {
41 if (document.getElementById) {
42 if (document.getElementById('issue_description')) {
42 if (document.getElementById('issue_description')) {
43 var commentTb = new jsToolBar(document.getElementById('issue_description'));
43 var commentTb = new jsToolBar(document.getElementById('issue_description'));
44 commentTb.draw();
44 commentTb.draw();
45 }
45 }
46 }
46 }
47 //]]>
47 //]]>
48 </script>
48 </script>
49 <% end %> No newline at end of file
49 <% end %>
General Comments 0
You need to be logged in to leave comments. Login now