##// END OF EJS Templates
xss in issue subject on issues/edit...
Jean-Philippe Lang -
r104:6c8e1514aa0c
parent child
Show More
@@ -1,49 +1,49
1 <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%= @issue.subject %></h2>
1 <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%=h @issue.subject %></h2>
2 2
3 3 <% labelled_tabular_form_for :issue, @issue, :url => {:action => 'edit'} do |f| %>
4 4 <%= error_messages_for 'issue' %>
5 5 <div class="box">
6 6 <!--[form:issue]-->
7 7 <div class="splitcontentleft">
8 8 <p><label><%=l(:field_status)%></label> <%= @issue.status.name %></p>
9 9 <p><%= f.select :priority_id, (@priorities.collect {|p| [p.name, p.id]}), :required => true %></p>
10 10 <p><%= f.select :assigned_to_id, (@issue.project.members.collect {|m| [m.name, m.user_id]}), :include_blank => true %></p>
11 11 <p><%= f.select :category_id, (@project.issue_categories.collect {|c| [c.name, c.id]}) %></p>
12 12 </div>
13 13
14 14 <div class="splitcontentright">
15 15 <p><%= f.text_field :start_date, :size => 10 %><%= calendar_for('issue_start_date') %></p>
16 16 <p><%= f.text_field :due_date, :size => 10 %><%= calendar_for('issue_due_date') %></p>
17 17 <p><%= f.select :done_ratio, ((0..10).to_a.collect {|r| ["#{r*10} %", r*10] }) %></p>
18 18 </div>
19 19
20 20 <div class="clear">
21 21 <p><%= f.text_field :subject, :size => 80, :required => true %></p>
22 22 <p><%= f.text_area :description, :cols => 60, :rows => [[10, @issue.description.length / 50].max, 100].min, :required => true %></p>
23 23
24 24 <% for @custom_value in @custom_values %>
25 25 <p><%= custom_field_tag_with_label @custom_value %></p>
26 26 <% end %>
27 27
28 28 <p><%= f.select :fixed_version_id, (@project.versions.collect {|v| [v.name, v.id]}), { :include_blank => true } %>
29 29 </select></p>
30 30 </div>
31 31 <!--[eoform:issue]-->
32 32 </div>
33 33 <%= f.hidden_field :lock_version %>
34 34 <%= submit_tag l(:button_save) %>
35 35 <% end %>
36 36
37 37 <% unless $RDM_TEXTILE_DISABLED %>
38 38 <%= javascript_include_tag 'jstoolbar' %>
39 39 <script type="text/javascript">
40 40 //<![CDATA[
41 41 if (document.getElementById) {
42 42 if (document.getElementById('issue_description')) {
43 43 var commentTb = new jsToolBar(document.getElementById('issue_description'));
44 44 commentTb.draw();
45 45 }
46 46 }
47 47 //]]>
48 48 </script>
49 49 <% end %> No newline at end of file
General Comments 0
You need to be logged in to leave comments. Login now