jro_apps/redmine Commit - r15058:8c09e330d42d

Merged r15431 to r15435 (#22924, #22925, #22926)....

Jean-Philippe Lang -

r15058:8c09e330d42d

parent child

Context file:

r15058:8c09e330d42d

Collapse all files

lib/redmine/helpers/url.rb created 644 +35 0

@@ -0,0 +1,35
	1	# Redmine - project management software
	2	# Copyright (C) 2006-2016 Jean-Philippe Lang
	3	#
	4	# This program is free software; you can redistribute it and/or
	5	# modify it under the terms of the GNU General Public License
	6	# as published by the Free Software Foundation; either version 2
	7	# of the License, or (at your option) any later version.
	8	#
	9	# This program is distributed in the hope that it will be useful,
	10	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	# GNU General Public License for more details.
	13	#
	14	# You should have received a copy of the GNU General Public License
	15	# along with this program; if not, write to the Free Software
	16	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	17
	18	require 'uri'
	19
	20	module Redmine
	21	module Helpers
	22	module URL
	23	def uri_with_safe_scheme?(uri, schemes = ['http', 'https', 'ftp', 'mailto', nil])
	24	# URLs relative to the current document or document root (without a protocol
	25	# separator, should be harmless
	26	return true unless uri.include? ":"
	27
	28	# Other URLs need to be parsed
	29	schemes.include? URI.parse(uri).scheme
	30	rescue URI::InvalidURIError
	31	false
	32	end
	33	end
	34	end
	35	end

app/helpers/application_helper.rb +1 0

             # encoding: utf-8
             #
             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'forwardable'
             require 'cgi'
             module ApplicationHelper
               include Redmine::WikiFormatting::Macros::Definitions
               include Redmine::I18n
               include GravatarHelper::PublicMethods
               include Redmine::Pagination::Helper
               include Redmine::SudoMode::Helper
               include Redmine::Themes::Helper
               include Redmine::Hook::Helper
+              include Redmine::Helpers::URL
               extend Forwardable
               def_delegators :wiki_helper, :wikitoolbar_for, :heads_for_wiki_formatter
               # Return true if user is authorized for controller/action, otherwise false
               def authorize_for(controller, action)
                 User.current.allowed_to?({:controller => controller, :action => action}, @project)
               end
               # Display a link if user is authorized
               #
               # @param [String] name Anchor text (passed to link_to)
               # @param [Hash] options Hash params. This will checked by authorize_for to see if the user is authorized
               # @param [optional, Hash] html_options Options passed to link_to
               # @param [optional, Hash] parameters_for_method_reference Extra parameters for link_to
               def link_to_if_authorized(name, options = {}, html_options = nil, *parameters_for_method_reference)
                 link_to(name, options, html_options, *parameters_for_method_reference) if authorize_for(options[:controller] || params[:controller], options[:action])
               end
               # Displays a link to user's account page if active
               def link_to_user(user, options={})
                 if user.is_a?(User)
                   name = h(user.name(options[:format]))
                   if user.active? || (User.current.admin? && user.logged?)
                     link_to name, user_path(user), :class => user.css_classes
                   else
                     name
                   end
                 else
                   h(user.to_s)
                 end
               end
               # Displays a link to +issue+ with its subject.
               # Examples:
               #
               #   link_to_issue(issue)                        # => Defect #6: This is the subject
               #   link_to_issue(issue, :truncate => 6)        # => Defect #6: This i...
               #   link_to_issue(issue, :subject => false)     # => Defect #6
               #   link_to_issue(issue, :project => true)      # => Foo - Defect #6
               #   link_to_issue(issue, :subject => false, :tracker => false)     # => #6
               #
               def link_to_issue(issue, options={})
                 title = nil
                 subject = nil
                 text = options[:tracker] == false ? "##{issue.id}" : "#{issue.tracker} ##{issue.id}"
                 if options[:subject] == false
                   title = issue.subject.truncate(60)
                 else
                   subject = issue.subject
                   if truncate_length = options[:truncate]
                     subject = subject.truncate(truncate_length)
                   end
                 end
                 only_path = options[:only_path].nil? ? true : options[:only_path]
                 s = link_to(text, issue_url(issue, :only_path => only_path),
                             :class => issue.css_classes, :title => title)
                 s << h(": #{subject}") if subject
                 s = h("#{issue.project} - ") + s if options[:project]
                 s
               end
               # Generates a link to an attachment.
               # Options:
               # * :text - Link text (default to attachment filename)
               # * :download - Force download (default: false)
               def link_to_attachment(attachment, options={})
                 text = options.delete(:text) || attachment.filename
                 route_method = options.delete(:download) ? :download_named_attachment_url : :named_attachment_url
                 html_options = options.slice!(:only_path)
                 options[:only_path] = true unless options.key?(:only_path)
                 url = send(route_method, attachment, attachment.filename, options)
                 link_to text, url, html_options
               end
               # Generates a link to a SCM revision
               # Options:
               # * :text - Link text (default to the formatted revision)
               def link_to_revision(revision, repository, options={})
                 if repository.is_a?(Project)
                   repository = repository.repository
                 end
                 text = options.delete(:text) || format_revision(revision)
                 rev = revision.respond_to?(:identifier) ? revision.identifier : revision
                 link_to(
                     h(text),
                     {:controller => 'repositories', :action => 'revision', :id => repository.project, :repository_id => repository.identifier_param, :rev => rev},
                     :title => l(:label_revision_id, format_revision(revision)),
                     :accesskey => options[:accesskey]
                   )
               end
               # Generates a link to a message
               def link_to_message(message, options={}, html_options = nil)
                 link_to(
                   message.subject.truncate(60),
                   board_message_url(message.board_id, message.parent_id || message.id, {
                     :r => (message.parent_id && message.id),
                     :anchor => (message.parent_id ? "message-#{message.id}" : nil),
                     :only_path => true
                   }.merge(options)),
                   html_options
                 )
               end
               # Generates a link to a project if active
               # Examples:
               #
               #   link_to_project(project)                          # => link to the specified project overview
               #   link_to_project(project, {:only_path => false}, :class => "project") # => 3rd arg adds html options
               #   link_to_project(project, {}, :class => "project") # => html options with default url (project overview)
               #
               def link_to_project(project, options={}, html_options = nil)
                 if project.archived?
                   h(project.name)
                 else
                   link_to project.name,
                     project_url(project, {:only_path => true}.merge(options)),
                     html_options
                 end
               end
               # Generates a link to a project settings if active
               def link_to_project_settings(project, options={}, html_options=nil)
                 if project.active?
                   link_to project.name, settings_project_path(project, options), html_options
                 elsif project.archived?
                   h(project.name)
                 else
                   link_to project.name, project_path(project, options), html_options
                 end
               end
               # Generates a link to a version
               def link_to_version(version, options = {})
                 return '' unless version && version.is_a?(Version)
                 options = {:title => format_date(version.effective_date)}.merge(options)
                 link_to_if version.visible?, format_version_name(version), version_path(version), options
               end
               # Helper that formats object for html or text rendering
               def format_object(object, html=true, &block)
                 if block_given?
                   object = yield object
                 end
                 case object.class.name
                 when 'Array'
                   object.map {|o| format_object(o, html)}.join(', ').html_safe
                 when 'Time'
                   format_time(object)
                 when 'Date'
                   format_date(object)
                 when 'Fixnum'
                   object.to_s
                 when 'Float'
                   sprintf "%.2f", object
                 when 'User'
                   html ? link_to_user(object) : object.to_s
                 when 'Project'
                   html ? link_to_project(object) : object.to_s
                 when 'Version'
                   html ? link_to_version(object) : object.to_s
                 when 'TrueClass'
                   l(:general_text_Yes)
                 when 'FalseClass'
                   l(:general_text_No)
                 when 'Issue'
                   object.visible? && html ? link_to_issue(object) : "##{object.id}"
                 when 'CustomValue', 'CustomFieldValue'
                   if object.custom_field
                     f = object.custom_field.format.formatted_custom_value(self, object, html)
                     if f.nil? || f.is_a?(String)
                       f
                     else
                       format_object(f, html, &block)
                     end
                   else
                     object.value.to_s
                   end
                 else
                   html ? h(object) : object.to_s
                 end
               end
               def wiki_page_path(page, options={})
                 url_for({:controller => 'wiki', :action => 'show', :project_id => page.project, :id => page.title}.merge(options))
               end
               def thumbnail_tag(attachment)
                 link_to image_tag(thumbnail_path(attachment)),
                   named_attachment_path(attachment, attachment.filename),
                   :title => attachment.filename
               end
               def toggle_link(name, id, options={})
                 onclick = "$('##{id}').toggle(); "
                 onclick << (options[:focus] ? "$('##{options[:focus]}').focus(); " : "this.blur(); ")
                 onclick << "return false;"
                 link_to(name, "#", :onclick => onclick)
               end
               def format_activity_title(text)
                 h(truncate_single_line_raw(text, 100))
               end
               def format_activity_day(date)
                 date == User.current.today ? l(:label_today).titleize : format_date(date)
               end
               def format_activity_description(text)
                 h(text.to_s.truncate(120).gsub(%r{[\r\n]*<(pre|code)>.*$}m, '...')
                    ).gsub(/[\r\n]+/, "<br />").html_safe
               end
               def format_version_name(version)
                 if version.project == @project
                   h(version)
                 else
                   h("#{version.project} - #{version}")
                 end
               end
               def due_date_distance_in_words(date)
                 if date
                   l((date < User.current.today ? :label_roadmap_overdue : :label_roadmap_due_in), distance_of_date_in_words(User.current.today, date))
                 end
               end
               # Renders a tree of projects as a nested set of unordered lists
               # The given collection may be a subset of the whole project tree
               # (eg. some intermediate nodes are private and can not be seen)
               def render_project_nested_lists(projects, &block)
                 s = ''
                 if projects.any?
                   ancestors = []
                   original_project = @project
                   projects.sort_by(&:lft).each do |project|
                     # set the project environment to please macros.
                     @project = project
                     if (ancestors.empty? || project.is_descendant_of?(ancestors.last))
                       s << "<ul class='projects #{ ancestors.empty? ? 'root' : nil}'>\n"
                     else
                       ancestors.pop
                       s << "</li>"
                       while (ancestors.any? && !project.is_descendant_of?(ancestors.last))
                         ancestors.pop
                         s << "</ul></li>\n"
                       end
                     end
                     classes = (ancestors.empty? ? 'root' : 'child')
                     s << "<li class='#{classes}'><div class='#{classes}'>"
                     s << h(block_given? ? capture(project, &block) : project.name)
                     s << "</div>\n"
                     ancestors << project
                   end
                   s << ("</li></ul>\n" * ancestors.size)
                   @project = original_project
                 end
                 s.html_safe
               end
               def render_page_hierarchy(pages, node=nil, options={})
                 content = ''
                 if pages[node]
                   content << "<ul class=\"pages-hierarchy\">\n"
                   pages[node].each do |page|
                     content << "<li>"
                     content << link_to(h(page.pretty_title), {:controller => 'wiki', :action => 'show', :project_id => page.project, :id => page.title, :version => nil},
                                        :title => (options[:timestamp] && page.updated_on ? l(:label_updated_time, distance_of_time_in_words(Time.now, page.updated_on)) : nil))
                     content << "\n" + render_page_hierarchy(pages, page.id, options) if pages[page.id]
                     content << "</li>\n"
                   end
                   content << "</ul>\n"
                 end
                 content.html_safe
               end
               # Renders flash messages
               def render_flash_messages
                 s = ''
                 flash.each do |k,v|
                   s << content_tag('div', v.html_safe, :class => "flash #{k}", :id => "flash_#{k}")
                 end
                 s.html_safe
               end
               # Renders tabs and their content
               def render_tabs(tabs, selected=params[:tab])
                 if tabs.any?
                   unless tabs.detect {|tab| tab[:name] == selected}
                     selected = nil
                   end
                   selected ||= tabs.first[:name]
                   render :partial => 'common/tabs', :locals => {:tabs => tabs, :selected_tab => selected}
                 else
                   content_tag 'p', l(:label_no_data), :class => "nodata"
                 end
               end
               # Renders the project quick-jump box
               def render_project_jump_box
                 return unless User.current.logged?
                 projects = User.current.projects.active.select(:id, :name, :identifier, :lft, :rgt).to_a
                 if projects.any?
                   options =
                     ("<option value=''>#{ l(:label_jump_to_a_project) }</option>" +
                      '<option value="" disabled="disabled">---</option>').html_safe
                   options << project_tree_options_for_select(projects, :selected => @project) do |p|
                     { :value => project_path(:id => p, :jump => current_menu_item) }
                   end
                   content_tag( :span, nil, :class => 'jump-box-arrow') +
                   select_tag('project_quick_jump_box', options, :onchange => 'if (this.value != \'\') { window.location = this.value; }')
                 end
               end
               def project_tree_options_for_select(projects, options = {})
                 s = ''.html_safe
                 if blank_text = options[:include_blank]
                   if blank_text == true
                     blank_text = '&nbsp;'.html_safe
                   end
                   s << content_tag('option', blank_text, :value => '')
                 end
                 project_tree(projects) do |project, level|
                   name_prefix = (level > 0 ? '&nbsp;' * 2 * level + '&#187; ' : '').html_safe
                   tag_options = {:value => project.id}
                   if project == options[:selected] || (options[:selected].respond_to?(:include?) && options[:selected].include?(project))
                     tag_options[:selected] = 'selected'
                   else
                     tag_options[:selected] = nil
                   end
                   tag_options.merge!(yield(project)) if block_given?
                   s << content_tag('option', name_prefix + h(project), tag_options)
                 end
                 s.html_safe
               end
               # Yields the given block for each project with its level in the tree
               #
               # Wrapper for Project#project_tree
               def project_tree(projects, &block)
                 Project.project_tree(projects, &block)
               end
               def principals_check_box_tags(name, principals)
                 s = ''
                 principals.each do |principal|
                   s << "<label>#{ check_box_tag name, principal.id, false, :id => nil } #{h principal}</label>\n"
                 end
                 s.html_safe
               end
               # Returns a string for users/groups option tags
               def principals_options_for_select(collection, selected=nil)
                 s = ''
                 if collection.include?(User.current)
                   s << content_tag('option', "<< #{l(:label_me)} >>", :value => User.current.id)
                 end
                 groups = ''
                 collection.sort.each do |element|
                   selected_attribute = ' selected="selected"' if option_value_selected?(element, selected) || element.id.to_s == selected
                   (element.is_a?(Group) ? groups : s) << %(<option value="#{element.id}"#{selected_attribute}>#{h element.name}</option>)
                 end
                 unless groups.empty?
                   s << %(<optgroup label="#{h(l(:label_group_plural))}">#{groups}</optgroup>)
                 end
                 s.html_safe
               end
               def option_tag(name, text, value, selected=nil, options={})
                 content_tag 'option', value, options.merge(:value => value, :selected => (value == selected))
               end
               def truncate_single_line_raw(string, length)
                 string.to_s.truncate(length).gsub(%r{[\r\n]+}m, ' ')
               end
               # Truncates at line break after 250 characters or options[:length]
               def truncate_lines(string, options={})
                 length = options[:length] || 250
                 if string.to_s =~ /\A(.{#{length}}.*?)$/m
                   "#{$1}..."
                 else
                   string
                 end
               end
               def anchor(text)
                 text.to_s.gsub(' ', '_')
               end
               def html_hours(text)
                 text.gsub(%r{(\d+)\.(\d+)}, '<span class="hours hours-int">\1</span><span class="hours hours-dec">.\2</span>').html_safe
               end
               def authoring(created, author, options={})
                 l(options[:label] || :label_added_time_by, :author => link_to_user(author), :age => time_tag(created)).html_safe
               end
               def time_tag(time)
                 text = distance_of_time_in_words(Time.now, time)
                 if @project
                   link_to(text, project_activity_path(@project, :from => User.current.time_to_date(time)), :title => format_time(time))
                 else
                   content_tag('abbr', text, :title => format_time(time))
                 end
               end
               def syntax_highlight_lines(name, content)
                 lines = []
                 syntax_highlight(name, content).each_line { |line| lines << line }
                 lines
               end
               def syntax_highlight(name, content)
                 Redmine::SyntaxHighlighting.highlight_by_filename(content, name)
               end
               def to_path_param(path)
                 str = path.to_s.split(%r{[/\\]}).select{|p| !p.blank?}.join("/")
                 str.blank? ? nil : str
               end
               def reorder_links(name, url, method = :post)
                 # TODO: remove associated styles from application.css too
                 ActiveSupport::Deprecation.warn "Application#reorder_links will be removed in Redmine 4."
                 link_to(l(:label_sort_highest),
                         url.merge({"#{name}[move_to]" => 'highest'}), :method => method,
                         :title => l(:label_sort_highest), :class => 'icon-only icon-move-top') +
                 link_to(l(:label_sort_higher),
                         url.merge({"#{name}[move_to]" => 'higher'}), :method => method,
                         :title => l(:label_sort_higher), :class => 'icon-only icon-move-up') +
                 link_to(l(:label_sort_lower),
                         url.merge({"#{name}[move_to]" => 'lower'}), :method => method,
                         :title => l(:label_sort_lower), :class => 'icon-only icon-move-down') +
                 link_to(l(:label_sort_lowest),
                         url.merge({"#{name}[move_to]" => 'lowest'}), :method => method,
                         :title => l(:label_sort_lowest), :class => 'icon-only icon-move-bottom')
               end
               def reorder_handle(object, options={})
                 data = {
                   :reorder_url => options[:url] || url_for(object),
                   :reorder_param => options[:param] || object.class.name.underscore
                 }
                 content_tag('span', '',
                   :class => "sort-handle",
                   :data => data,
                   :title => l(:button_sort))
               end
               def breadcrumb(*args)
                 elements = args.flatten
                 elements.any? ? content_tag('p', (args.join(" \xc2\xbb ") + " \xc2\xbb ").html_safe, :class => 'breadcrumb') : nil
               end
               def other_formats_links(&block)
                 concat('<p class="other-formats">'.html_safe + l(:label_export_to))
                 yield Redmine::Views::OtherFormatsBuilder.new(self)
                 concat('</p>'.html_safe)
               end
               def page_header_title
                 if @project.nil? || @project.new_record?
                   h(Setting.app_title)
                 else
                   b = []
                   ancestors = (@project.root? ? [] : @project.ancestors.visible.to_a)
                   if ancestors.any?
                     root = ancestors.shift
                     b << link_to_project(root, {:jump => current_menu_item}, :class => 'root')
                     if ancestors.size > 2
                       b << "\xe2\x80\xa6"
                       ancestors = ancestors[-2, 2]
                     end
                     b += ancestors.collect {|p| link_to_project(p, {:jump => current_menu_item}, :class => 'ancestor') }
                   end
                   b << content_tag(:span, h(@project), class: 'current-project')
                   if b.size > 1
                     separator = content_tag(:span, ' &raquo; '.html_safe, class: 'separator')
                     path = safe_join(b[0..-2], separator) + separator
                     b = [content_tag(:span, path.html_safe, class: 'breadcrumbs'), b[-1]]
                   end
                   safe_join b
                 end
               end
               # Returns a h2 tag and sets the html title with the given arguments
               def title(*args)
                 strings = args.map do |arg|
                   if arg.is_a?(Array) && arg.size >= 2
                     link_to(*arg)
                   else
                     h(arg.to_s)
                   end
                 end
                 html_title args.reverse.map {|s| (s.is_a?(Array) ? s.first : s).to_s}
                 content_tag('h2', strings.join(' &#187; ').html_safe)
               end
               # Sets the html title
               # Returns the html title when called without arguments
               # Current project name and app_title and automatically appended
               # Exemples:
               #   html_title 'Foo', 'Bar'
               #   html_title # => 'Foo - Bar - My Project - Redmine'
               def html_title(*args)
                 if args.empty?
                   title = @html_title || []
                   title << @project.name if @project
                   title << Setting.app_title unless Setting.app_title == title.last
                   title.reject(&:blank?).join(' - ')
                 else
                   @html_title ||= []
                   @html_title += args
                 end
               end
               # Returns the theme, controller name, and action as css classes for the
               # HTML body.
               def body_css_classes
                 css = []
                 if theme = Redmine::Themes.theme(Setting.ui_theme)
                   css << 'theme-' + theme.name
                 end
                 css << 'project-' + @project.identifier if @project && @project.identifier.present?
                 css << 'controller-' + controller_name
                 css << 'action-' + action_name
                 css.join(' ')
               end
               def accesskey(s)
                 @used_accesskeys ||= []
                 key = Redmine::AccessKeys.key_for(s)
                 return nil if @used_accesskeys.include?(key)
                 @used_accesskeys << key
                 key
               end
               # Formats text according to system settings.
               # 2 ways to call this method:
               # * with a String: textilizable(text, options)
               # * with an object and one of its attribute: textilizable(issue, :description, options)
               def textilizable(*args)
                 options = args.last.is_a?(Hash) ? args.pop : {}
                 case args.size
                 when 1
                   obj = options[:object]
                   text = args.shift
                 when 2
                   obj = args.shift
                   attr = args.shift
                   text = obj.send(attr).to_s
                 else
                   raise ArgumentError, 'invalid arguments to textilizable'
                 end
                 return '' if text.blank?
                 project = options[:project] || @project || (obj && obj.respond_to?(:project) ? obj.project : nil)
                 @only_path = only_path = options.delete(:only_path) == false ? false : true
                 text = text.dup
                 macros = catch_macros(text)
                 text = Redmine::WikiFormatting.to_html(Setting.text_formatting, text, :object => obj, :attribute => attr)
                 @parsed_headings = []
                 @heading_anchors = {}
                 @current_section = 0 if options[:edit_section_links]
                 parse_sections(text, project, obj, attr, only_path, options)
                 text = parse_non_pre_blocks(text, obj, macros) do |text|
                   [:parse_inline_attachments, :parse_wiki_links, :parse_redmine_links].each do |method_name|
                     send method_name, text, project, obj, attr, only_path, options
                   end
                 end
                 parse_headings(text, project, obj, attr, only_path, options)
                 if @parsed_headings.any?
                   replace_toc(text, @parsed_headings)
                 end
                 text.html_safe
               end
               def parse_non_pre_blocks(text, obj, macros)
                 s = StringScanner.new(text)
                 tags = []
                 parsed = ''
                 while !s.eos?
                   s.scan(/(.*?)(<(\/)?(pre|code)(.*?)>|\z)/im)
                   text, full_tag, closing, tag = s[1], s[2], s[3], s[4]
                   if tags.empty?
                     yield text
                     inject_macros(text, obj, macros) if macros.any?
                   else
                     inject_macros(text, obj, macros, false) if macros.any?
                   end
                   parsed << text
                   if tag
                     if closing
                       if tags.last && tags.last.casecmp(tag) == 0
                         tags.pop
                       end
                     else
                       tags << tag.downcase
                     end
                     parsed << full_tag
                   end
                 end
                 # Close any non closing tags
                 while tag = tags.pop
                   parsed << "</#{tag}>"
                 end
                 parsed
               end
               def parse_inline_attachments(text, project, obj, attr, only_path, options)
                 return if options[:inline_attachments] == false
                 # when using an image link, try to use an attachment, if possible
                 attachments = options[:attachments] || []
                 attachments += obj.attachments if obj.respond_to?(:attachments)
                 if attachments.present?
                   text.gsub!(/src="([^\/"]+\.(bmp|gif|jpg|jpe|jpeg|png))"(\s+alt="([^"]*)")?/i) do |m|
                     filename, ext, alt, alttext = $1.downcase, $2, $3, $4
                     # search for the picture in attachments
                     if found = Attachment.latest_attach(attachments, CGI.unescape(filename))
                       image_url = download_named_attachment_url(found, found.filename, :only_path => only_path)
                       desc = found.description.to_s.gsub('"', '')
                       if !desc.blank? && alttext.blank?
                         alt = " title=\"#{desc}\" alt=\"#{desc}\""
                       end
                       "src=\"#{image_url}\"#{alt}"
                     else
                       m
                     end
                   end
                 end
               end
               # Wiki links
               #
               # Examples:
               #   [[mypage]]
               #   [[mypage|mytext]]
               # wiki links can refer other project wikis, using project name or identifier:
               #   [[project:]] -> wiki starting page
               #   [[project:|mytext]]
               #   [[project:mypage]]
               #   [[project:mypage|mytext]]
               def parse_wiki_links(text, project, obj, attr, only_path, options)
                 text.gsub!(/(!)?(\[\[([^\]\n\|]+)(\|([^\]\n\|]+))?\]\])/) do |m|
                   link_project = project
                   esc, all, page, title = $1, $2, $3, $5
                   if esc.nil?
                     if page =~ /^([^\:]+)\:(.*)$/
                       identifier, page = $1, $2
                       link_project = Project.find_by_identifier(identifier) || Project.find_by_name(identifier)
                       title ||= identifier if page.blank?
                     end
                     if link_project && link_project.wiki
                       # extract anchor
                       anchor = nil
                       if page =~ /^(.+?)\#(.+)$/
                         page, anchor = $1, $2
                       end
                       anchor = sanitize_anchor_name(anchor) if anchor.present?
                       # check if page exists
                       wiki_page = link_project.wiki.find_page(page)
                       url = if anchor.present? && wiki_page.present? && (obj.is_a?(WikiContent) || obj.is_a?(WikiContent::Version)) && obj.page == wiki_page
                         "##{anchor}"
                       else
                         case options[:wiki_links]
                         when :local; "#{page.present? ? Wiki.titleize(page) : ''}.html" + (anchor.present? ? "##{anchor}" : '')
                         when :anchor; "##{page.present? ? Wiki.titleize(page) : title}" + (anchor.present? ? "_#{anchor}" : '') # used for single-file wiki export
                         else
                           wiki_page_id = page.present? ? Wiki.titleize(page) : nil
                           parent = wiki_page.nil? && obj.is_a?(WikiContent) && obj.page && project == link_project ? obj.page.title : nil
                           url_for(:only_path => only_path, :controller => 'wiki', :action => 'show', :project_id => link_project,
                            :id => wiki_page_id, :version => nil, :anchor => anchor, :parent => parent)
                         end
                       end
                       link_to(title.present? ? title.html_safe : h(page), url, :class => ('wiki-page' + (wiki_page ? '' : ' new')))
                     else
                       # project or wiki doesn't exist
                       all
                     end
                   else
                     all
                   end
                 end
               end
               # Redmine links
               #
               # Examples:
               #   Issues:
               #     #52 -> Link to issue #52
               #   Changesets:
               #     r52 -> Link to revision 52
               #     commit:a85130f -> Link to scmid starting with a85130f
               #   Documents:
               #     document#17 -> Link to document with id 17
               #     document:Greetings -> Link to the document with title "Greetings"
               #     document:"Some document" -> Link to the document with title "Some document"
               #   Versions:
               #     version#3 -> Link to version with id 3
               #     version:1.0.0 -> Link to version named "1.0.0"
               #     version:"1.0 beta 2" -> Link to version named "1.0 beta 2"
               #   Attachments:
               #     attachment:file.zip -> Link to the attachment of the current object named file.zip
               #   Source files:
               #     source:some/file -> Link to the file located at /some/file in the project's repository
               #     source:some/file@52 -> Link to the file's revision 52
               #     source:some/file#L120 -> Link to line 120 of the file
               #     source:some/file@52#L120 -> Link to line 120 of the file's revision 52
               #     export:some/file -> Force the download of the file
               #   Forum messages:
               #     message#1218 -> Link to message with id 1218
               #  Projects:
               #     project:someproject -> Link to project named "someproject"
               #     project#3 -> Link to project with id 3
               #
               #   Links can refer other objects from other projects, using project identifier:
               #     identifier:r52
               #     identifier:document:"Some document"
               #     identifier:version:1.0.0
               #     identifier:source:some/file
               def parse_redmine_links(text, default_project, obj, attr, only_path, options)
                 text.gsub!(%r{<a( [^>]+?)?>(.*?)</a>|([\s\(,\-\[\>]|^)(!)?(([a-z0-9\-_]+):)?(attachment|document|version|forum|news|message|project|commit|source|export)?(((#)|((([a-z0-9\-_]+)\|)?(r)))((\d+)((#note)?-(\d+))?)|(:)([^"\s<>][^\s<>]*?|"[^"]+?"))(?=(?=[[:punct:]][^A-Za-z0-9_/])|,|\s|\]|<|$)}) do |m|
                   tag_content, leading, esc, project_prefix, project_identifier, prefix, repo_prefix, repo_identifier, sep, identifier, comment_suffix, comment_id = $2, $3, $4, $5, $6, $7, $12, $13, $10 || $14 || $20, $16 || $21, $17, $19
                   if tag_content
                     $&
                   else
                     link = nil
                     project = default_project
                     if project_identifier
                       project = Project.visible.find_by_identifier(project_identifier)
                     end
                     if esc.nil?
                       if prefix.nil? && sep == 'r'
                         if project
                           repository = nil
                           if repo_identifier
                             repository = project.repositories.detect {|repo| repo.identifier == repo_identifier}
                           else
                             repository = project.repository
                           end
                           # project.changesets.visible raises an SQL error because of a double join on repositories
                           if repository &&
                                (changeset = Changeset.visible.
                                                 find_by_repository_id_and_revision(repository.id, identifier))
                             link = link_to(h("#{project_prefix}#{repo_prefix}r#{identifier}"),
                                            {:only_path => only_path, :controller => 'repositories',
                                             :action => 'revision', :id => project,
                                             :repository_id => repository.identifier_param,
                                             :rev => changeset.revision},
                                            :class => 'changeset',
                                            :title => truncate_single_line_raw(changeset.comments, 100))
                           end
                         end
                       elsif sep == '#'
                         oid = identifier.to_i
                         case prefix
                         when nil
                           if oid.to_s == identifier &&
                             issue = Issue.visible.find_by_id(oid)
                             anchor = comment_id ? "note-#{comment_id}" : nil
                             link = link_to("##{oid}#{comment_suffix}",
                                            issue_url(issue, :only_path => only_path, :anchor => anchor),
                                            :class => issue.css_classes,
                                            :title => "#{issue.tracker.name}: #{issue.subject.truncate(100)} (#{issue.status.name})")
                           end
                         when 'document'
                           if document = Document.visible.find_by_id(oid)
                             link = link_to(document.title, document_url(document, :only_path => only_path), :class => 'document')
                           end
                         when 'version'
                           if version = Version.visible.find_by_id(oid)
                             link = link_to(version.name, version_url(version, :only_path => only_path), :class => 'version')
                           end
                         when 'message'
                           if message = Message.visible.find_by_id(oid)
                             link = link_to_message(message, {:only_path => only_path}, :class => 'message')
                           end
                         when 'forum'
                           if board = Board.visible.find_by_id(oid)
                             link = link_to(board.name, project_board_url(board.project, board, :only_path => only_path), :class => 'board')
                           end
                         when 'news'
                           if news = News.visible.find_by_id(oid)
                             link = link_to(news.title, news_url(news, :only_path => only_path), :class => 'news')
                           end
                         when 'project'
                           if p = Project.visible.find_by_id(oid)
                             link = link_to_project(p, {:only_path => only_path}, :class => 'project')
                           end
                         end
                       elsif sep == ':'
                         # removes the double quotes if any
                         name = identifier.gsub(%r{^"(.*)"$}, "\\1")
                         name = CGI.unescapeHTML(name)
                         case prefix
                         when 'document'
                           if project && document = project.documents.visible.find_by_title(name)
                             link = link_to(document.title, document_url(document, :only_path => only_path), :class => 'document')
                           end
                         when 'version'
                           if project && version = project.versions.visible.find_by_name(name)
                             link = link_to(version.name, version_url(version, :only_path => only_path), :class => 'version')
                           end
                         when 'forum'
                           if project && board = project.boards.visible.find_by_name(name)
                             link = link_to(board.name, project_board_url(board.project, board, :only_path => only_path), :class => 'board')
                           end
                         when 'news'
                           if project && news = project.news.visible.find_by_title(name)
                             link = link_to(news.title, news_url(news, :only_path => only_path), :class => 'news')
                           end
                         when 'commit', 'source', 'export'
                           if project
                             repository = nil
                             if name =~ %r{^(([a-z0-9\-_]+)\|)(.+)$}
                               repo_prefix, repo_identifier, name = $1, $2, $3
                               repository = project.repositories.detect {|repo| repo.identifier == repo_identifier}
                             else
                               repository = project.repository
                             end
                             if prefix == 'commit'
                               if repository && (changeset = Changeset.visible.where("repository_id = ? AND scmid LIKE ?", repository.id, "#{name}%").first)
                                 link = link_to h("#{project_prefix}#{repo_prefix}#{name}"), {:only_path => only_path, :controller => 'repositories', :action => 'revision', :id => project, :repository_id => repository.identifier_param, :rev => changeset.identifier},
                                                              :class => 'changeset',
                                                              :title => truncate_single_line_raw(changeset.comments, 100)
                               end
                             else
                               if repository && User.current.allowed_to?(:browse_repository, project)
                                 name =~ %r{^[/\\]*(.*?)(@([^/\\@]+?))?(#(L\d+))?$}
                                 path, rev, anchor = $1, $3, $5
                                 link = link_to h("#{project_prefix}#{prefix}:#{repo_prefix}#{name}"), {:only_path => only_path, :controller => 'repositories', :action => (prefix == 'export' ? 'raw' : 'entry'), :id => project, :repository_id => repository.identifier_param,
                                                                         :path => to_path_param(path),
                                                                         :rev => rev,
                                                                         :anchor => anchor},
                                                                        :class => (prefix == 'export' ? 'source download' : 'source')
                               end
                             end
                             repo_prefix = nil
                           end
                         when 'attachment'
                           attachments = options[:attachments] || []
                           attachments += obj.attachments if obj.respond_to?(:attachments)
                           if attachments && attachment = Attachment.latest_attach(attachments, name)
                             link = link_to_attachment(attachment, :only_path => only_path, :download => true, :class => 'attachment')
                           end
                         when 'project'
                           if p = Project.visible.where("identifier = :s OR LOWER(name) = :s", :s => name.downcase).first
                             link = link_to_project(p, {:only_path => only_path}, :class => 'project')
                           end
                         end
                       end
                     end
                     (leading + (link || "#{project_prefix}#{prefix}#{repo_prefix}#{sep}#{identifier}#{comment_suffix}"))
                   end
                 end
               end
               HEADING_RE = /(<h(\d)( [^>]+)?>(.+?)<\/h(\d)>)/i unless const_defined?(:HEADING_RE)
               def parse_sections(text, project, obj, attr, only_path, options)
                 return unless options[:edit_section_links]
                 text.gsub!(HEADING_RE) do
                   heading, level = $1, $2
                   @current_section += 1
                   if @current_section > 1
                     content_tag('div',
                       link_to(l(:button_edit_section), options[:edit_section_links].merge(:section => @current_section),
                               :class => 'icon-only icon-edit'),
                       :class => "contextual heading-#{level}",
                       :title => l(:button_edit_section),
                       :id => "section-#{@current_section}") + heading.html_safe
                   else
                     heading
                   end
                 end
               end
               # Headings and TOC
               # Adds ids and links to headings unless options[:headings] is set to false
               def parse_headings(text, project, obj, attr, only_path, options)
                 return if options[:headings] == false
                 text.gsub!(HEADING_RE) do
                   level, attrs, content = $2.to_i, $3, $4
                   item = strip_tags(content).strip
                   anchor = sanitize_anchor_name(item)
                   # used for single-file wiki export
                   anchor = "#{obj.page.title}_#{anchor}" if options[:wiki_links] == :anchor && (obj.is_a?(WikiContent) || obj.is_a?(WikiContent::Version))
                   @heading_anchors[anchor] ||= 0
                   idx = (@heading_anchors[anchor] += 1)
                   if idx > 1
                     anchor = "#{anchor}-#{idx}"
                   end
                   @parsed_headings << [level, anchor, item]
                   "<a name=\"#{anchor}\"></a>\n<h#{level} #{attrs}>#{content}<a href=\"##{anchor}\" class=\"wiki-anchor\">&para;</a></h#{level}>"
                 end
               end
               MACROS_RE = /(
                             (!)?                        # escaping
                             (
                             \{\{                        # opening tag
                             ([\w]+)                     # macro name
                             (\(([^\n\r]*?)\))?          # optional arguments
                             ([\n\r].*?[\n\r])?          # optional block of text
                             \}\}                        # closing tag
                             )
                            )/mx unless const_defined?(:MACROS_RE)
               MACRO_SUB_RE = /(
                               \{\{
                               macro\((\d+)\)
                               \}\}
                               )/x unless const_defined?(:MACRO_SUB_RE)
               # Extracts macros from text
               def catch_macros(text)
                 macros = {}
                 text.gsub!(MACROS_RE) do
                   all, macro = $1, $4.downcase
                   if macro_exists?(macro) || all =~ MACRO_SUB_RE
                     index = macros.size
                     macros[index] = all
                     "{{macro(#{index})}}"
                   else
                     all
                   end
                 end
                 macros
               end
               # Executes and replaces macros in text
               def inject_macros(text, obj, macros, execute=true)
                 text.gsub!(MACRO_SUB_RE) do
                   all, index = $1, $2.to_i
                   orig = macros.delete(index)
                   if execute && orig && orig =~ MACROS_RE
                     esc, all, macro, args, block = $2, $3, $4.downcase, $6.to_s, $7.try(:strip)
                     if esc.nil?
                       h(exec_macro(macro, obj, args, block) || all)
                     else
                       h(all)
                     end
                   elsif orig
                     h(orig)
                   else
                     h(all)
                   end
                 end
               end
               TOC_RE = /<p>\{\{((<|&lt;)|(>|&gt;))?toc\}\}<\/p>/i unless const_defined?(:TOC_RE)
               # Renders the TOC with given headings
               def replace_toc(text, headings)
                 text.gsub!(TOC_RE) do
                   left_align, right_align = $2, $3
                   # Keep only the 4 first levels
                   headings = headings.select{|level, anchor, item| level <= 4}
                   if headings.empty?
                     ''
                   else
                     div_class = 'toc'
                     div_class << ' right' if right_align
                     div_class << ' left' if left_align
                     out = "<ul class=\"#{div_class}\"><li>"
                     root = headings.map(&:first).min
                     current = root
                     started = false
                     headings.each do |level, anchor, item|
                       if level > current
                         out << '<ul><li>' * (level - current)
                       elsif level < current
                         out << "</li></ul>\n" * (current - level) + "</li><li>"
                       elsif started
                         out << '</li><li>'
                       end
                       out << "<a href=\"##{anchor}\">#{item}</a>"
                       current = level
                       started = true
                     end
                     out << '</li></ul>' * (current - root)
                     out << '</li></ul>'
                   end
                 end
               end
               # Same as Rails' simple_format helper without using paragraphs
               def simple_format_without_paragraph(text)
                 text.to_s.
                   gsub(/\r\n?/, "\n").                    # \r\n and \r -> \n
                   gsub(/\n\n+/, "<br /><br />").          # 2+ newline  -> 2 br
                   gsub(/([^\n]\n)(?=[^\n])/, '\1<br />'). # 1 newline   -> br
                   html_safe
               end
               def lang_options_for_select(blank=true)
                 (blank ? [["(auto)", ""]] : []) + languages_options
               end
               def labelled_form_for(*args, &proc)
                 args << {} unless args.last.is_a?(Hash)
                 options = args.last
                 if args.first.is_a?(Symbol)
                   options.merge!(:as => args.shift)
                 end
                 options.merge!({:builder => Redmine::Views::LabelledFormBuilder})
                 form_for(*args, &proc)
               end
               def labelled_fields_for(*args, &proc)
                 args << {} unless args.last.is_a?(Hash)
                 options = args.last
                 options.merge!({:builder => Redmine::Views::LabelledFormBuilder})
                 fields_for(*args, &proc)
               end
               # Render the error messages for the given objects
               def error_messages_for(*objects)
                 objects = objects.map {|o| o.is_a?(String) ? instance_variable_get("@#{o}") : o}.compact
                 errors = objects.map {|o| o.errors.full_messages}.flatten
                 render_error_messages(errors)
               end
               # Renders a list of error messages
               def render_error_messages(errors)
                 html = ""
                 if errors.present?
                   html << "<div id='errorExplanation'><ul>\n"
                   errors.each do |error|
                     html << "<li>#{h error}</li>\n"
                   end
                   html << "</ul></div>\n"
                 end
                 html.html_safe
               end
               def delete_link(url, options={})
                 options = {
                   :method => :delete,
                   :data => {:confirm => l(:text_are_you_sure)},
                   :class => 'icon icon-del'
                 }.merge(options)
                 link_to l(:button_delete), url, options
               end
               def preview_link(url, form, target='preview', options={})
                 content_tag 'a', l(:label_preview), {
                     :href => "#",
                     :onclick => %|submitPreview("#{escape_javascript url_for(url)}", "#{escape_javascript form}", "#{escape_javascript target}"); return false;|,
                     :accesskey => accesskey(:preview)
                   }.merge(options)
               end
               def link_to_function(name, function, html_options={})
                 content_tag(:a, name, {:href => '#', :onclick => "#{function}; return false;"}.merge(html_options))
               end
               # Helper to render JSON in views
               def raw_json(arg)
                 arg.to_json.to_s.gsub('/', '\/').html_safe
               end
               def back_url
                 url = params[:back_url]
                 if url.nil? && referer = request.env['HTTP_REFERER']
                   url = CGI.unescape(referer.to_s)
                 end
                 url
               end
               def back_url_hidden_field_tag
                 url = back_url
                 hidden_field_tag('back_url', url, :id => nil) unless url.blank?
               end
               def check_all_links(form_name)
                 link_to_function(l(:button_check_all), "checkAll('#{form_name}', true)") +
                 " | ".html_safe +
                 link_to_function(l(:button_uncheck_all), "checkAll('#{form_name}', false)")
               end
               def toggle_checkboxes_link(selector)
                 link_to_function '',
                   "toggleCheckboxesBySelector('#{selector}')",
                   :title => "#{l(:button_check_all)} / #{l(:button_uncheck_all)}",
                   :class => 'toggle-checkboxes'
               end
               def progress_bar(pcts, options={})
                 pcts = [pcts, pcts] unless pcts.is_a?(Array)
                 pcts = pcts.collect(&:round)
                 pcts[1] = pcts[1] - pcts[0]
                 pcts << (100 - pcts[1] - pcts[0])
                 titles = options[:titles].to_a
                 titles[0] = "#{pcts[0]}%" if titles[0].blank?
                 legend = options[:legend] || ''
                 content_tag('table',
                   content_tag('tr',
                     (pcts[0] > 0 ? content_tag('td', '', :style => "width: #{pcts[0]}%;", :class => 'closed', :title => titles[0]) : ''.html_safe) +
                     (pcts[1] > 0 ? content_tag('td', '', :style => "width: #{pcts[1]}%;", :class => 'done', :title => titles[1]) : ''.html_safe) +
                     (pcts[2] > 0 ? content_tag('td', '', :style => "width: #{pcts[2]}%;", :class => 'todo', :title => titles[2]) : ''.html_safe)
                   ), :class => "progress progress-#{pcts[0]}").html_safe +
                   content_tag('p', legend, :class => 'percent').html_safe
               end
               def checked_image(checked=true)
                 if checked
                   @checked_image_tag ||= content_tag(:span, nil, :class => 'icon-only icon-checked')
                 end
               end
               def context_menu(url)
                 unless @context_menu_included
                   content_for :header_tags do
                     javascript_include_tag('context_menu') +
                       stylesheet_link_tag('context_menu')
                   end
                   if l(:direction) == 'rtl'
                     content_for :header_tags do
                       stylesheet_link_tag('context_menu_rtl')
                     end
                   end
                   @context_menu_included = true
                 end
                 javascript_tag "contextMenuInit('#{ url_for(url) }')"
               end
               def calendar_for(field_id)
                 include_calendar_headers_tags
                 javascript_tag("$(function() { $('##{field_id}').addClass('date').datepickerFallback(datepickerOptions); });")
               end
               def include_calendar_headers_tags
                 unless @calendar_headers_tags_included
                   tags = ''.html_safe
                   @calendar_headers_tags_included = true
                   content_for :header_tags do
                     start_of_week = Setting.start_of_week
                     start_of_week = l(:general_first_day_of_week, :default => '1') if start_of_week.blank?
                     # Redmine uses 1..7 (monday..sunday) in settings and locales
                     # JQuery uses 0..6 (sunday..saturday), 7 needs to be changed to 0
                     start_of_week = start_of_week.to_i % 7
                     tags << javascript_tag(
                                "var datepickerOptions={dateFormat: 'yy-mm-dd', firstDay: #{start_of_week}, " +
                                  "showOn: 'button', buttonImageOnly: true, buttonImage: '" +
                                  path_to_image('/images/calendar.png') +
                                  "', showButtonPanel: true, showWeek: true, showOtherMonths: true, " +
                                  "selectOtherMonths: true, changeMonth: true, changeYear: true, " +
                                  "beforeShow: beforeShowDatePicker};")
                     jquery_locale = l('jquery.locale', :default => current_language.to_s)
                     unless jquery_locale == 'en'
                       tags << javascript_include_tag("i18n/datepicker-#{jquery_locale}.js")
                     end
                     tags
                   end
                 end
               end
               # Overrides Rails' stylesheet_link_tag with themes and plugins support.
               # Examples:
               #   stylesheet_link_tag('styles') # => picks styles.css from the current theme or defaults
               #   stylesheet_link_tag('styles', :plugin => 'foo) # => picks styles.css from plugin's assets
               #
               def stylesheet_link_tag(*sources)
                 options = sources.last.is_a?(Hash) ? sources.pop : {}
                 plugin = options.delete(:plugin)
                 sources = sources.map do |source|
                   if plugin
                     "/plugin_assets/#{plugin}/stylesheets/#{source}"
                   elsif current_theme && current_theme.stylesheets.include?(source)
                     current_theme.stylesheet_path(source)
                   else
                     source
                   end
                 end
                 super *sources, options
               end
               # Overrides Rails' image_tag with themes and plugins support.
               # Examples:
               #   image_tag('image.png') # => picks image.png from the current theme or defaults
               #   image_tag('image.png', :plugin => 'foo) # => picks image.png from plugin's assets
               #
               def image_tag(source, options={})
                 if plugin = options.delete(:plugin)
                   source = "/plugin_assets/#{plugin}/images/#{source}"
                 elsif current_theme && current_theme.images.include?(source)
                   source = current_theme.image_path(source)
                 end
                 super source, options
               end
               # Overrides Rails' javascript_include_tag with plugins support
               # Examples:
               #   javascript_include_tag('scripts') # => picks scripts.js from defaults
               #   javascript_include_tag('scripts', :plugin => 'foo) # => picks scripts.js from plugin's assets
               #
               def javascript_include_tag(*sources)
                 options = sources.last.is_a?(Hash) ? sources.pop : {}
                 if plugin = options.delete(:plugin)
                   sources = sources.map do |source|
                     if plugin
                       "/plugin_assets/#{plugin}/javascripts/#{source}"
                     else
                       source
                     end
                   end
                 end
                 super *sources, options
               end
               def sidebar_content?
                 content_for?(:sidebar) || view_layouts_base_sidebar_hook_response.present?
               end
               def view_layouts_base_sidebar_hook_response
                 @view_layouts_base_sidebar_hook_response ||= call_hook(:view_layouts_base_sidebar)
               end
               def email_delivery_enabled?
                 !!ActionMailer::Base.perform_deliveries
               end
               # Returns the avatar image tag for the given +user+ if avatars are enabled
               # +user+ can be a User or a string that will be scanned for an email address (eg. 'joe <joe@foo.bar>')
               def avatar(user, options = { })
                 if Setting.gravatar_enabled?
                   options.merge!(:default => Setting.gravatar_default)
                   email = nil
                   if user.respond_to?(:mail)
                     email = user.mail
                   elsif user.to_s =~ %r{<(.+?)>}
                     email = $1
                   end
                   return gravatar(email.to_s.downcase, options) unless email.blank? rescue nil
                 else
                   ''
                 end
               end
               # Returns a link to edit user's avatar if avatars are enabled
               def avatar_edit_link(user, options={})
                 if Setting.gravatar_enabled?
                   url = "https://gravatar.com"
                   link_to avatar(user, {:title => l(:button_edit)}.merge(options)), url, :target => '_blank'
                 end
               end
               def sanitize_anchor_name(anchor)
                 anchor.gsub(%r{[^\s\-\p{Word}]}, '').gsub(%r{\s+(\-+\s*)?}, '-')
               end
               # Returns the javascript tags that are included in the html layout head
               def javascript_heads
                 tags = javascript_include_tag('jquery-1.11.1-ui-1.11.0-ujs-3.1.4', 'application', 'responsive')
                 unless User.current.pref.warn_on_leaving_unsaved == '0'
                   tags << "\n".html_safe + javascript_tag("$(window).load(function(){ warnLeavingUnsaved('#{escape_javascript l(:text_warn_on_leaving_unsaved)}'); });")
                 end
                 tags
               end
               def favicon
                 "<link rel='shortcut icon' href='#{favicon_path}' />".html_safe
               end
               # Returns the path to the favicon
               def favicon_path
                 icon = (current_theme && current_theme.favicon?) ? current_theme.favicon_path : '/favicon.ico'
                 image_path(icon)
               end
               # Returns the full URL to the favicon
               def favicon_url
                 # TODO: use #image_url introduced in Rails4
                 path = favicon_path
                 base = url_for(:controller => 'welcome', :action => 'index', :only_path => false)
                 base.sub(%r{/+$},'') + '/' + path.sub(%r{^/+},'')
               end
               def robot_exclusion_tag
                 '<meta name="robots" content="noindex,follow,noarchive" />'.html_safe
               end
               # Returns true if arg is expected in the API response
               def include_in_api_response?(arg)
                 unless @included_in_api_response
                   param = params[:include]
                   @included_in_api_response = param.is_a?(Array) ? param.collect(&:to_s) : param.to_s.split(',')
                   @included_in_api_response.collect!(&:strip)
                 end
                 @included_in_api_response.include?(arg.to_s)
               end
               # Returns options or nil if nometa param or X-Redmine-Nometa header
               # was set in the request
               def api_meta(options)
                 if params[:nometa].present? || request.headers['X-Redmine-Nometa']
                   # compatibility mode for activeresource clients that raise
                   # an error when deserializing an array with attributes
                   nil
                 else
                   options
                 end
               end
               def generate_csv(&block)
                 decimal_separator = l(:general_csv_decimal_separator)
                 encoding = l(:general_csv_encoding)
               end
               private
               def wiki_helper
                 helper = Redmine::WikiFormatting.helper_for(Setting.text_formatting)
                 extend helper
                 return self
               end
               def link_to_content_update(text, url_params = {}, html_options = {})
                 link_to(text, url_params, html_options)
               end
             end

app/models/custom_field.rb +8 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class CustomField < ActiveRecord::Base
               include Redmine::SubclassFactory
               has_many :enumerations,
                        lambda { order(:position) },
                        :class_name => 'CustomFieldEnumeration',
                        :dependent => :delete_all
               has_many :custom_values, :dependent => :delete_all
               has_and_belongs_to_many :roles, :join_table => "#{table_name_prefix}custom_fields_roles#{table_name_suffix}", :foreign_key => "custom_field_id"
               acts_as_positioned
               serialize :possible_values
               store :format_store
               validates_presence_of :name, :field_format
               validates_uniqueness_of :name, :scope => :type
               validates_length_of :name, :maximum => 30
               validates_inclusion_of :field_format, :in => Proc.new { Redmine::FieldFormat.available_formats }
               validate :validate_custom_field
               attr_protected :id
               before_validation :set_searchable
               before_save do |field|
                 field.format.before_custom_field_save(field)
               end
               after_save :handle_multiplicity_change
               after_save do |field|
                 if field.visible_changed? && field.visible
                   field.roles.clear
                 end
               end
               scope :sorted, lambda { order(:position) }
               scope :visible, lambda {|*args|
                 user = args.shift || User.current
                 if user.admin?
                   # nop
                 elsif user.memberships.any?
                   where("#{table_name}.visible = ? OR #{table_name}.id IN (SELECT DISTINCT cfr.custom_field_id FROM #{Member.table_name} m" +
                     " INNER JOIN #{MemberRole.table_name} mr ON mr.member_id = m.id" +
                     " INNER JOIN #{table_name_prefix}custom_fields_roles#{table_name_suffix} cfr ON cfr.role_id = mr.role_id" +
                     " WHERE m.user_id = ?)",
                     true, user.id)
                 else
                   where(:visible => true)
                 end
               }
               def visible_by?(project, user=User.current)
                 visible? || user.admin?
               end
               def format
                 @format ||= Redmine::FieldFormat.find(field_format)
               end
               def field_format=(arg)
                 # cannot change format of a saved custom field
                 if new_record?
                   @format = nil
                   super
                 end
               end
               def set_searchable
                 # make sure these fields are not searchable
                 self.searchable = false unless format.class.searchable_supported
                 # make sure only these fields can have multiple values
                 self.multiple = false unless format.class.multiple_supported
                 true
               end
               def validate_custom_field
                 format.validate_custom_field(self).each do |attribute, message|
                   errors.add attribute, message
                 end
                 if regexp.present?
                   begin
                     Regexp.new(regexp)
                   rescue
                     errors.add(:regexp, :invalid)
                   end
                 end
                 if default_value.present?
                   validate_field_value(default_value).each do |message|
                     errors.add :default_value, message
                   end
                 end
               end
               def possible_custom_value_options(custom_value)
                 format.possible_custom_value_options(custom_value)
               end
               def possible_values_options(object=nil)
                 if object.is_a?(Array)
                   object.map {|o| format.possible_values_options(self, o)}.reduce(:&) || []
                 else
                   format.possible_values_options(self, object) || []
                 end
               end
               def possible_values
                 values = read_attribute(:possible_values)
                 if values.is_a?(Array)
                   values.each do |value|
                     value.to_s.force_encoding('UTF-8')
                   end
                   values
                 else
                   []
                 end
               end
               # Makes possible_values accept a multiline string
               def possible_values=(arg)
                 if arg.is_a?(Array)
                   values = arg.compact.map {|a| a.to_s.strip}.reject(&:blank?)
                   write_attribute(:possible_values, values)
                 else
                   self.possible_values = arg.to_s.split(/[\n\r]+/)
                 end
               end
               def cast_value(value)
                 format.cast_value(self, value)
               end
               def value_from_keyword(keyword, customized)
                 format.value_from_keyword(self, keyword, customized)
               end
               # Returns the options hash used to build a query filter for the field
               def query_filter_options(query)
                 format.query_filter_options(self, query)
               end
               def totalable?
                 format.totalable_supported
               end
               # Returns a ORDER BY clause that can used to sort customized
               # objects by their value of the custom field.
               # Returns nil if the custom field can not be used for sorting.
               def order_statement
                 return nil if multiple?
                 format.order_statement(self)
               end
               # Returns a GROUP BY clause that can used to group by custom value
               # Returns nil if the custom field can not be used for grouping.
               def group_statement
                 return nil if multiple?
                 format.group_statement(self)
               end
               def join_for_order_statement
                 format.join_for_order_statement(self)
               end
               def visibility_by_project_condition(project_key=nil, user=User.current, id_column=nil)
                 if visible? || user.admin?
                   "1=1"
                 elsif user.anonymous?
                   "1=0"
                 else
                   project_key ||= "#{self.class.customized_class.table_name}.project_id"
                   id_column ||= id
                   "#{project_key} IN (SELECT DISTINCT m.project_id FROM #{Member.table_name} m" +
                     " INNER JOIN #{MemberRole.table_name} mr ON mr.member_id = m.id" +
                     " INNER JOIN #{table_name_prefix}custom_fields_roles#{table_name_suffix} cfr ON cfr.role_id = mr.role_id" +
                     " WHERE m.user_id = #{user.id} AND cfr.custom_field_id = #{id_column})"
                 end
               end
               def self.visibility_condition
                 if user.admin?
                   "1=1"
                 elsif user.anonymous?
                   "#{table_name}.visible"
                 else
                   "#{project_key} IN (SELECT DISTINCT m.project_id FROM #{Member.table_name} m" +
                     " INNER JOIN #{MemberRole.table_name} mr ON mr.member_id = m.id" +
                     " INNER JOIN #{table_name_prefix}custom_fields_roles#{table_name_suffix} cfr ON cfr.role_id = mr.role_id" +
                     " WHERE m.user_id = #{user.id} AND cfr.custom_field_id = #{id})"
                 end
               end
               def <=>(field)
                 position <=> field.position
               end
               # Returns the class that values represent
               def value_class
                 format.target_class if format.respond_to?(:target_class)
               end
               def self.customized_class
                 self.name =~ /^(.+)CustomField$/
                 $1.constantize rescue nil
               end
               # to move in project_custom_field
               def self.for_all
                 where(:is_for_all => true).order('position').to_a
               end
               def type_name
                 nil
               end
               # Returns the error messages for the given value
               # or an empty array if value is a valid value for the custom field
               def validate_custom_value(custom_value)
                 value = custom_value.value
                 errs = []
                 if value.is_a?(Array)
                   if !multiple?
                     errs << ::I18n.t('activerecord.errors.messages.invalid')
                   end
                   if is_required? && value.detect(&:present?).nil?
                     errs << ::I18n.t('activerecord.errors.messages.blank')
                   end
                 else
                   if is_required? && value.blank?
                     errs << ::I18n.t('activerecord.errors.messages.blank')
                   end
                 end
                 errs += format.validate_custom_value(custom_value)
                 errs
               end
               # Returns the error messages for the default custom field value
               def validate_field_value(value)
                 validate_custom_value(CustomFieldValue.new(:custom_field => self, :value => value))
               end
               # Returns true if value is a valid value for the custom field
               def valid_field_value?(value)
                 validate_field_value(value).empty?
               end
               def format_in?(*args)
                 args.include?(field_format)
               end
+              def self.human_attribute_name(attribute_key_name, *args)
+                attr_name = attribute_key_name.to_s
+                if attr_name == 'url_pattern'
+                  attr_name = "url"
+                end
+                super(attr_name, *args)
+              end
               protected
               # Removes multiple values for the custom field after setting the multiple attribute to false
               # We kepp the value with the highest id for each customized object
               def handle_multiplicity_change
                 if !new_record? && multiple_was && !multiple
                   ids = custom_values.
                     where("EXISTS(SELECT 1 FROM #{CustomValue.table_name} cve WHERE cve.custom_field_id = #{CustomValue.table_name}.custom_field_id" +
                       " AND cve.customized_type = #{CustomValue.table_name}.customized_type AND cve.customized_id = #{CustomValue.table_name}.customized_id" +
                       " AND cve.id > #{CustomValue.table_name}.id)").
                     pluck(:id)
                   if ids.any?
                     custom_values.where(:id => ids).delete_all
                   end
                 end
               end
             end
             require_dependency 'redmine/field_format'

app/views/projects/show.html.erb +1 -1

             <div class="contextual">
               <% if User.current.allowed_to?(:add_subprojects, @project) %>
                 <%= link_to l(:label_subproject_new), new_project_path(:parent_id => @project), :class => 'icon icon-add' %>
               <% end %>
               <% if User.current.allowed_to?(:close_project, @project) %>
                 <% if @project.active? %>
                   <%= link_to l(:button_close), close_project_path(@project), :data => {:confirm => l(:text_are_you_sure)}, :method => :post, :class => 'icon icon-lock' %>
                 <% else %>
                   <%= link_to l(:button_reopen), reopen_project_path(@project), :data => {:confirm => l(:text_are_you_sure)}, :method => :post, :class => 'icon icon-unlock' %>
                 <% end %>
               <% end %>
             </div>
             <h2><%=l(:label_overview)%></h2>
             <% unless @project.active? %>
               <p class="warning"><span class="icon icon-lock"><%= l(:text_project_closed) %></span></p>
             <% end %>
             <div class="splitcontentleft">
               <% if @project.description.present? %>
               <div class="wiki">
                 <%= textilizable @project.description %>
               </div>
               <% end %>
               <% if @project.homepage.present? || @subprojects.any? || @project.visible_custom_field_values.any?(&:present?) %>
               <ul>
               <% unless @project.homepage.blank? %>
-                <li><span class="label"><%=l(:field_homepage)%>:</span> <%= link_to @project.homepage, @project.homepage %></li>
+                <li><span class="label"><%=l(:field_homepage)%>:</span> <%= link_to_if uri_with_safe_scheme?(@project.homepage), @project.homepage, @project.homepage %></li>
               <% end %>
               <% if @subprojects.any? %>
                 <li><span class="label"><%=l(:label_subproject_plural)%>:</span>
                   <%= @subprojects.collect{|p| link_to p, project_path(p)}.join(", ").html_safe %></li>
               <% end %>
               <% render_custom_field_values(@project) do |custom_field, formatted| %>
                 <li><span class="label"><%= custom_field.name %>:</span> <%= formatted %></li>
               <% end %>
               </ul>
               <% end %>
               <% if User.current.allowed_to?(:view_issues, @project) %>
               <div class="issues box">
                 <h3><%=l(:label_issue_tracking)%></h3>
                 <% if @trackers.present? %>
                 <table class="list issue-report">
                   <thead>
                     <tr>
                       <th></th>
                       <th><%=l(:label_open_issues_plural)%></th>
                       <th><%=l(:label_closed_issues_plural)%></th>
                       <th><%=l(:label_total)%></th>
                     </tr>
                   </thead>
                   <tbody>
                   <% @trackers.each do |tracker| %>
                     <tr class="<%= cycle("odd", "even") %>">
                       <td class="name">
                         <%= link_to tracker.name, project_issues_path(@project, :set_filter => 1, :tracker_id => tracker.id) %>
                       </td>
                       <td>
                         <%= link_to @open_issues_by_tracker[tracker].to_i, project_issues_path(@project, :set_filter => 1, :tracker_id => tracker.id) %>
                       </td>
                       <td>
                         <%= link_to (@total_issues_by_tracker[tracker].to_i - @open_issues_by_tracker[tracker].to_i), project_issues_path(@project, :set_filter => 1, :tracker_id => tracker.id, :status_id => 'c') %>
                       </td>
                       <td>
                         <%= link_to @total_issues_by_tracker[tracker].to_i, project_issues_path(@project, :set_filter => 1, :tracker_id => tracker.id, :status_id => '*') %>
                       </td>
                     </tr>
                   <% end %>
                   </tbody>
                 </table>
                 <% end %>
                 <p>
                   <%= link_to l(:label_issue_view_all), project_issues_path(@project, :set_filter => 1) %>
                   <% if User.current.allowed_to?(:view_calendar, @project, :global => true) %>
                     | <%= link_to l(:label_calendar), project_calendar_path(@project) %>
                   <% end %>
                   <% if User.current.allowed_to?(:view_gantt, @project, :global => true) %>
                     | <%= link_to l(:label_gantt), project_gantt_path(@project) %>
                   <% end %>
                 </p>
               </div>
               <% end %>
               <%= call_hook(:view_projects_show_left, :project => @project) %>
             </div>
             <div class="splitcontentright">
               <%= render :partial => 'members_box' %>
               <% if @news.any? && authorize_for('news', 'index') %>
               <div class="news box">
                 <h3><%=l(:label_news_latest)%></h3>
                 <%= render :partial => 'news/news', :collection => @news %>
                 <p><%= link_to l(:label_news_view_all), project_news_index_path(@project) %></p>
               </div>
               <% end %>
               <%= call_hook(:view_projects_show_right, :project => @project) %>
             </div>
             <% content_for :sidebar do %>
               <%= render :partial => 'projects/sidebar' %>
             <% end %>
             <% content_for :header_tags do %>
             <%= auto_discovery_link_tag(:atom, {:controller => 'activities', :action => 'index', :id => @project, :format => 'atom', :key => User.current.rss_key}) %>
             <% end %>
             <% html_title(l(:label_overview)) -%>

lib/redcloth3.rb +3 0

             #                                vim:ts=4:sw=4:
             # = RedCloth - Textile and Markdown Hybrid for Ruby
             #
             # Homepage::  http://whytheluckystiff.net/ruby/redcloth/
             # Author::    why the lucky stiff (http://whytheluckystiff.net/)
             # Copyright:: (cc) 2004 why the lucky stiff (and his puppet organizations.)
             # License::   BSD
             #
             # (see http://hobix.com/textile/ for a Textile Reference.)
             #
             # Based on (and also inspired by) both:
             #
             # PyTextile: http://diveintomark.org/projects/textile/textile.py.txt
             # Textism for PHP: http://www.textism.com/tools/textile/
             #
             #
             # = RedCloth
             #
             # RedCloth is a Ruby library for converting Textile and/or Markdown
             # into HTML.  You can use either format, intermingled or separately.
             # You can also extend RedCloth to honor your own custom text stylings.
             #
             # RedCloth users are encouraged to use Textile if they are generating
             # HTML and to use Markdown if others will be viewing the plain text.
             #
             # == What is Textile?
             #
             # Textile is a simple formatting style for text
             # documents, loosely based on some HTML conventions.
             #
             # == Sample Textile Text
             #
             #  h2. This is a title
             #
             #  h3. This is a subhead
             #
             #  This is a bit of paragraph.
             #
             #  bq. This is a blockquote.
             #
             # = Writing Textile
             #
             # A Textile document consists of paragraphs.  Paragraphs
             # can be specially formatted by adding a small instruction
             # to the beginning of the paragraph.
             #
             #  h[n].   Header of size [n].
             #  bq.     Blockquote.
             #  #       Numeric list.
             #  *       Bulleted list.
             #
             # == Quick Phrase Modifiers
             #
             # Quick phrase modifiers are also included, to allow formatting
             # of small portions of text within a paragraph.
             #
             #  \_emphasis\_
             #  \_\_italicized\_\_
             #  \*strong\*
             #  \*\*bold\*\*
             #  ??citation??
             #  -deleted text-
             #  +inserted text+
             #  ^superscript^
             #  ~subscript~
             #  @code@
             #  %(classname)span%
             #
             #  ==notextile== (leave text alone)
             #
             # == Links
             #
             # To make a hypertext link, put the link text in "quotation
             # marks" followed immediately by a colon and the URL of the link.
             #
             # Optional: text in (parentheses) following the link text,
             # but before the closing quotation mark, will become a Title
             # attribute for the link, visible as a tool tip when a cursor is above it.
             #
             # Example:
             #
             #  "This is a link (This is a title) ":http://www.textism.com
             #
             # Will become:
             #
             #  <a href="http://www.textism.com" title="This is a title">This is a link</a>
             #
             # == Images
             #
             # To insert an image, put the URL for the image inside exclamation marks.
             #
             # Optional: text that immediately follows the URL in (parentheses) will
             # be used as the Alt text for the image. Images on the web should always
             # have descriptive Alt text for the benefit of readers using non-graphical
             # browsers.
             #
             # Optional: place a colon followed by a URL immediately after the
             # closing ! to make the image into a link.
             #
             # Example:
             #
             #  !http://www.textism.com/common/textist.gif(Textist)!
             #
             # Will become:
             #
             #  <img src="http://www.textism.com/common/textist.gif" alt="Textist" />
             #
             # With a link:
             #
             #  !/common/textist.gif(Textist)!:http://textism.com
             #
             # Will become:
             #
             #  <a href="http://textism.com"><img src="/common/textist.gif" alt="Textist" /></a>
             #
             # == Defining Acronyms
             #
             # HTML allows authors to define acronyms via the tag. The definition appears as a
             # tool tip when a cursor hovers over the acronym. A crucial aid to clear writing,
             # this should be used at least once for each acronym in documents where they appear.
             #
             # To quickly define an acronym in Textile, place the full text in (parentheses)
             # immediately following the acronym.
             #
             # Example:
             #
             #  ACLU(American Civil Liberties Union)
             #
             # Will become:
             #
             #  <abbr title="American Civil Liberties Union">ACLU</abbr>
             #
             # == Adding Tables
             #
             # In Textile, simple tables can be added by separating each column by
             # a pipe.
             #
             #     |a|simple|table|row|
             #     |And|Another|table|row|
             #
             # Attributes are defined by style definitions in parentheses.
             #
             #     table(border:1px solid black).
             #     (background:#ddd;color:red). |{}| | | |
             #
             # == Using RedCloth
             #
             # RedCloth is simply an extension of the String class, which can handle
             # Textile formatting.  Use it like a String and output HTML with its
             # RedCloth#to_html method.
             #
             #  doc = RedCloth.new "
             #
             #  h2. Test document
             #
             #  Just a simple test."
             #
             #  puts doc.to_html
             #
             # By default, RedCloth uses both Textile and Markdown formatting, with
             # Textile formatting taking precedence.  If you want to turn off Markdown
             # formatting, to boost speed and limit the processor:
             #
             #  class RedCloth::Textile.new( str )
             class RedCloth3 < String
+                include Redmine::Helpers::URL
                 VERSION = '3.0.4'
                 DEFAULT_RULES = [:textile, :markdown]
                 #
                 # Two accessor for setting security restrictions.
                 #
                 # This is a nice thing if you're using RedCloth for
                 # formatting in public places (e.g. Wikis) where you
                 # don't want users to abuse HTML for bad things.
                 #
                 # If +:filter_html+ is set, HTML which wasn't
                 # created by the Textile processor will be escaped.
                 #
                 # If +:filter_styles+ is set, it will also disable
                 # the style markup specifier. ('{color: red}')
                 #
                 attr_accessor :filter_html, :filter_styles
                 #
                 # Accessor for toggling hard breaks.
                 #
                 # If +:hard_breaks+ is set, single newlines will
                 # be converted to HTML break tags.  This is the
                 # default behavior for traditional RedCloth.
                 #
                 attr_accessor :hard_breaks
                 # Accessor for toggling lite mode.
                 #
                 # In lite mode, block-level rules are ignored.  This means
                 # that tables, paragraphs, lists, and such aren't available.
                 # Only the inline markup for bold, italics, entities and so on.
                 #
                 #   r = RedCloth.new( "And then? She *fell*!", [:lite_mode] )
                 #   r.to_html
                 #   #=> "And then? She <strong>fell</strong>!"
                 #
                 attr_accessor :lite_mode
                 #
                 # Accessor for toggling span caps.
                 #
                 # Textile places `span' tags around capitalized
                 # words by default, but this wreaks havoc on Wikis.
                 # If +:no_span_caps+ is set, this will be
                 # suppressed.
                 #
                 attr_accessor :no_span_caps
                 #
                 # Establishes the markup predence.  Available rules include:
                 #
                 # == Textile Rules
                 #
                 # The following textile rules can be set individually.  Or add the complete
                 # set of rules with the single :textile rule, which supplies the rule set in
                 # the following precedence:
                 #
                 # refs_textile::          Textile references (i.e. [hobix]http://hobix.com/)
                 # block_textile_table::   Textile table block structures
                 # block_textile_lists::   Textile list structures
                 # block_textile_prefix::  Textile blocks with prefixes (i.e. bq., h2., etc.)
                 # inline_textile_image::  Textile inline images
                 # inline_textile_link::   Textile inline links
                 # inline_textile_span::   Textile inline spans
                 # glyphs_textile:: Textile entities (such as em-dashes and smart quotes)
                 #
                 # == Markdown
                 #
                 # refs_markdown::         Markdown references (for example: [hobix]: http://hobix.com/)
                 # block_markdown_setext:: Markdown setext headers
                 # block_markdown_atx::    Markdown atx headers
                 # block_markdown_rule::   Markdown horizontal rules
                 # block_markdown_bq::     Markdown blockquotes
                 # block_markdown_lists::  Markdown lists
                 # inline_markdown_link::  Markdown links
                 attr_accessor :rules
                 # Returns a new RedCloth object, based on _string_ and
                 # enforcing all the included _restrictions_.
                 #
                 #   r = RedCloth.new( "h1. A <b>bold</b> man", [:filter_html] )
                 #   r.to_html
                 #     #=>"<h1>A &lt;b&gt;bold&lt;/b&gt; man</h1>"
                 #
                 def initialize( string, restrictions = [] )
                     restrictions.each { |r| method( "#{ r }=" ).call( true ) }
                     super( string )
                 end
                 #
                 # Generates HTML from the Textile contents.
                 #
                 #   r = RedCloth.new( "And then? She *fell*!" )
                 #   r.to_html( true )
                 #     #=>"And then? She <strong>fell</strong>!"
                 #
                 def to_html( *rules )
                     rules = DEFAULT_RULES if rules.empty?
                     # make our working copy
                     text = self.dup
                     @urlrefs = {}
                     @shelf = []
                     textile_rules = [:block_textile_table, :block_textile_lists,
                                      :block_textile_prefix, :inline_textile_image, :inline_textile_link,
                                      :inline_textile_code, :inline_textile_span, :glyphs_textile]
                     markdown_rules = [:refs_markdown, :block_markdown_setext, :block_markdown_atx, :block_markdown_rule,
                                       :block_markdown_bq, :block_markdown_lists,
                                       :inline_markdown_reflink, :inline_markdown_link]
                     @rules = rules.collect do |rule|
                         case rule
                         when :markdown
                             markdown_rules
                         when :textile
                             textile_rules
                         else
                             rule
                         end
                     end.flatten
                     # standard clean up
                     incoming_entities text
                     clean_white_space text
                     # start processor
                     @pre_list = []
                     rip_offtags text
                     no_textile text
                     escape_html_tags text
                     # need to do this before #hard_break and #blocks
                     block_textile_quotes text unless @lite_mode
                     hard_break text
                     unless @lite_mode
                         refs text
                         blocks text
                     end
                     inline text
                     smooth_offtags text
                     retrieve text
                     text.gsub!( /<\/?notextile>/, '' )
                     text.gsub!( /x%x%/, '&#38;' )
                     clean_html text if filter_html
                     text.strip!
                     text
                 end
                 #######
                 private
                 #######
                 #
                 # Mapping of 8-bit ASCII codes to HTML numerical entity equivalents.
                 # (from PyTextile)
                 #
                 TEXTILE_TAGS =
                     [[128, 8364], [129, 0], [130, 8218], [131, 402], [132, 8222], [133, 8230],
                      [134, 8224], [135, 8225], [136, 710], [137, 8240], [138, 352], [139, 8249],
                      [140, 338], [141, 0], [142, 0], [143, 0], [144, 0], [145, 8216], [146, 8217],
                      [147, 8220], [148, 8221], [149, 8226], [150, 8211], [151, 8212], [152, 732],
                      [153, 8482], [154, 353], [155, 8250], [156, 339], [157, 0], [158, 0], [159, 376]].
                     collect! do |a, b|
                         [a.chr, ( b.zero? and "" or "&#{ b };" )]
                     end
                 #
                 # Regular expressions to convert to HTML.
                 #
                 A_HLGN = /(?:(?:<>|<|>|\=|[()]+)+)/
                 A_VLGN = /[\-^~]/
                 C_CLAS = '(?:\([^")]+\))'
                 C_LNGE = '(?:\[[a-z\-_]+\])'
                 C_STYL = '(?:\{[^"}]+\})'
                 S_CSPN = '(?:\\\\\d+)'
                 S_RSPN = '(?:/\d+)'
                 A = "(?:#{A_HLGN}?#{A_VLGN}?|#{A_VLGN}?#{A_HLGN}?)"
                 S = "(?:#{S_CSPN}?#{S_RSPN}|#{S_RSPN}?#{S_CSPN}?)"
                 C = "(?:#{C_CLAS}?#{C_STYL}?#{C_LNGE}?|#{C_STYL}?#{C_LNGE}?#{C_CLAS}?|#{C_LNGE}?#{C_STYL}?#{C_CLAS}?)"
                 # PUNCT = Regexp::quote( '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~' )
                 PUNCT = Regexp::quote( '!"#$%&\'*+,-./:;=?@\\^_`|~' )
                 PUNCT_NOQ = Regexp::quote( '!"#$&\',./:;=?@\\`|' )
                 PUNCT_Q = Regexp::quote( '*-_+^~%' )
                 HYPERLINK = '(\S+?)([^\w\s/;=\?]*?)(?=\s|<|$)'
                 # Text markup tags, don't conflict with block tags
                 SIMPLE_HTML_TAGS = [
                     'tt', 'b', 'i', 'big', 'small', 'em', 'strong', 'dfn', 'code',
                     'samp', 'kbd', 'var', 'cite', 'abbr', 'acronym', 'a', 'img', 'br',
                     'br', 'map', 'q', 'sub', 'sup', 'span', 'bdo'
                 ]
                 QTAGS = [
                     ['**', 'b', :limit],
                     ['*', 'strong', :limit],
                     ['??', 'cite', :limit],
                     ['-', 'del', :limit],
                     ['__', 'i', :limit],
                     ['_', 'em', :limit],
                     ['%', 'span', :limit],
                     ['+', 'ins', :limit],
                     ['^', 'sup', :limit],
                     ['~', 'sub', :limit]
                 ]
                 QTAGS_JOIN = QTAGS.map {|rc, ht, rtype| Regexp::quote rc}.join('|')
                 QTAGS.collect! do |rc, ht, rtype|
                     rcq = Regexp::quote rc
                     re =
                         case rtype
                         when :limit
                             /(^|[>\s\(])          # sta
                             (?!\-\-)
                             (#{QTAGS_JOIN}|)      # oqs
                             (#{rcq})              # qtag
                             ([[:word:]]|[^\s].*?[^\s])    # content
                             (?!\-\-)
                             #{rcq}
                             (#{QTAGS_JOIN}|)      # oqa
                             (?=[[:punct:]]|<|\s|\)|$)/x
                         else
                             /(#{rcq})
                             (#{C})
                             (?::(\S+))?
                             ([[:word:]]|[^\s\-].*?[^\s\-])
                             #{rcq}/xm
                         end
                     [rc, ht, re, rtype]
                 end
                 # Elements to handle
                 GLYPHS = [
                 #   [ /([^\s\[{(>])?\'([dmst]\b|ll\b|ve\b|\s|:|$)/, '\1&#8217;\2' ], # single closing
                 #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)\'/, '\1&#8217;' ], # single closing
                 #   [ /\'(?=[#{PUNCT_Q}]*(s\b|[\s#{PUNCT_NOQ}]))/, '&#8217;' ], # single closing
                 #   [ /\'/, '&#8216;' ], # single opening
                 #   [ /</, '&lt;' ], # less-than
                 #   [ />/, '&gt;' ], # greater-than
                 #   [ /([^\s\[{(])?"(\s|:|$)/, '\1&#8221;\2' ], # double closing
                 #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)"/, '\1&#8221;' ], # double closing
                 #   [ /"(?=[#{PUNCT_Q}]*[\s#{PUNCT_NOQ}])/, '&#8221;' ], # double closing
                 #   [ /"/, '&#8220;' ], # double opening
                 #   [ /\b( )?\.{3}/, '\1&#8230;' ], # ellipsis
                 #   [ /\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/, '<acronym title="\2">\1</acronym>' ], # 3+ uppercase acronym
                 #   [ /(^|[^"][>\s])([A-Z][A-Z0-9 ]+[A-Z0-9])([^<A-Za-z0-9]|$)/, '\1<span class="caps">\2</span>\3', :no_span_caps ], # 3+ uppercase caps
                 #   [ /(\.\s)?\s?--\s?/, '\1&#8212;' ], # em dash
                 #   [ /\s->\s/, ' &rarr; ' ], # right arrow
                 #   [ /\s-\s/, ' &#8211; ' ], # en dash
                 #   [ /(\d+) ?x ?(\d+)/, '\1&#215;\2' ], # dimension sign
                 #   [ /\b ?[(\[]TM[\])]/i, '&#8482;' ], # trademark
                 #   [ /\b ?[(\[]R[\])]/i, '&#174;' ], # registered
                 #   [ /\b ?[(\[]C[\])]/i, '&#169;' ] # copyright
                 ]
                 H_ALGN_VALS = {
                     '<' => 'left',
                     '=' => 'center',
                     '>' => 'right',
                     '<>' => 'justify'
                 }
                 V_ALGN_VALS = {
                     '^' => 'top',
                     '-' => 'middle',
                     '~' => 'bottom'
                 }
                 #
                 # Flexible HTML escaping
                 #
                 def htmlesc( str, mode=:Quotes )
                   if str
                     str.gsub!( '&', '&amp;' )
                     str.gsub!( '"', '&quot;' ) if mode != :NoQuotes
                     str.gsub!( "'", '&#039;' ) if mode == :Quotes
                     str.gsub!( '<', '&lt;')
                     str.gsub!( '>', '&gt;')
                   end
                   str
                 end
                 # Search and replace for Textile glyphs (quotes, dashes, other symbols)
                 def pgl( text )
                     #GLYPHS.each do |re, resub, tog|
                     #    next if tog and method( tog ).call
                     #    text.gsub! re, resub
                     #end
                     text.gsub!(/\b([A-Z][A-Z0-9]{1,})\b(?:[(]([^)]*)[)])/) do |m|
                       "<abbr title=\"#{htmlesc $2}\">#{$1}</abbr>"
                     end
                 end
                 # Parses Textile attribute lists and builds an HTML attribute string
                 def pba( text_in, element = "" )
                     return '' unless text_in
                     style = []
                     text = text_in.dup
                     if element == 'td'
                         colspan = $1 if text =~ /\\(\d+)/
                         rowspan = $1 if text =~ /\/(\d+)/
                         style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
                     end
                     if text.sub!( /\{([^"}]*)\}/, '' ) && !filter_styles
                       sanitized = sanitize_styles($1)
                       style << "#{ sanitized };" unless sanitized.blank?
                     end
                     lang = $1 if
                         text.sub!( /\[([a-z\-_]+?)\]/, '' )
                     cls = $1 if
                         text.sub!( /\(([^()]+?)\)/, '' )
                     style << "padding-left:#{ $1.length }em;" if
                         text.sub!( /([(]+)/, '' )
                     style << "padding-right:#{ $1.length }em;" if text.sub!( /([)]+)/, '' )
                     style << "text-align:#{ h_align( $& ) };" if text =~ A_HLGN
                     cls, id = $1, $2 if cls =~ /^(.*?)#(.*)$/
                     atts = ''
                     atts << " style=\"#{ style.join }\"" unless style.empty?
                     atts << " class=\"#{ cls }\"" unless cls.to_s.empty?
                     atts << " lang=\"#{ lang }\"" if lang
                     atts << " id=\"#{ id }\"" if id
                     atts << " colspan=\"#{ colspan }\"" if colspan
                     atts << " rowspan=\"#{ rowspan }\"" if rowspan
                     atts
                 end
                 STYLES_RE = /^(color|width|height|border|background|padding|margin|font|text|float)(-[a-z]+)*:\s*((\d+%?|\d+px|\d+(\.\d+)?em|#[0-9a-f]+|[a-z]+)\s*)+$/i
                 def sanitize_styles(str)
                   styles = str.split(";").map(&:strip)
                   styles.reject! do |style|
                     !style.match(STYLES_RE)
                   end
                   styles.join(";")
                 end
                 TABLE_RE = /^(?:table(_?#{S}#{A}#{C})\. ?\n)?^(#{A}#{C}\.? ?\|.*?\|)(\n\n|\Z)/m
                 # Parses a Textile table block, building HTML from the result.
                 def block_textile_table( text )
                     text.gsub!( TABLE_RE ) do |matches|
                         tatts, fullrow = $~[1..2]
                         tatts = pba( tatts, 'table' )
                         tatts = shelve( tatts ) if tatts
                         rows = []
                         fullrow.gsub!(/([^|\s])\s*\n/, "\\1<br />")
                         fullrow.each_line do |row|
                             ratts, row = pba( $1, 'tr' ), $2 if row =~ /^(#{A}#{C}\. )(.*)/m
                             cells = []
                             # the regexp prevents wiki links with a | from being cut as cells
                             row.scan(/\|(_?#{S}#{A}#{C}\. ?)?((\[\[[^|\]]*\|[^|\]]*\]\]|[^|])*?)(?=\|)/) do |modifiers, cell|
                                 ctyp = 'd'
                                 ctyp = 'h' if modifiers && modifiers =~ /^_/
                                 catts = nil
                                 catts = pba( modifiers, 'td' ) if modifiers
                                 catts = shelve( catts ) if catts
                                 cells << "\t\t\t<t#{ ctyp }#{ catts }>#{ cell }</t#{ ctyp }>"
                             end
                             ratts = shelve( ratts ) if ratts
                             rows << "\t\t<tr#{ ratts }>\n#{ cells.join( "\n" ) }\n\t\t</tr>"
                         end
                         "\t<table#{ tatts }>\n#{ rows.join( "\n" ) }\n\t</table>\n\n"
                     end
                 end
                 LISTS_RE = /^([#*]+?#{C} .*?)$(?![^#*])/m
                 LISTS_CONTENT_RE = /^([#*]+)(#{A}#{C}) (.*)$/m
                 # Parses Textile lists and generates HTML
                 def block_textile_lists( text )
                     text.gsub!( LISTS_RE ) do |match|
                         lines = match.split( /\n/ )
                         last_line = -1
                         depth = []
                         lines.each_with_index do |line, line_id|
                             if line =~ LISTS_CONTENT_RE
                                 tl,atts,content = $~[1..3]
                                 if depth.last
                                     if depth.last.length > tl.length
                                         (depth.length - 1).downto(0) do |i|
                                             break if depth[i].length == tl.length
                                             lines[line_id - 1] << "</li>\n\t</#{ lT( depth[i] ) }l>\n\t"
                                             depth.pop
                                         end
                                     end
                                     if depth.last and depth.last.length == tl.length
                                         lines[line_id - 1] << '</li>'
                                     end
                                 end
                                 unless depth.last == tl
                                     depth << tl
                                     atts = pba( atts )
                                     atts = shelve( atts ) if atts
                                     lines[line_id] = "\t<#{ lT(tl) }l#{ atts }>\n\t<li>#{ content }"
                                 else
                                     lines[line_id] = "\t\t<li>#{ content }"
                                 end
                                 last_line = line_id
                             else
                                 last_line = line_id
                             end
                             if line_id - last_line > 1 or line_id == lines.length - 1
                                 while v = depth.pop
                                     lines[last_line] << "</li>\n\t</#{ lT( v ) }l>"
                                 end
                             end
                         end
                         lines.join( "\n" )
                     end
                 end
                 QUOTES_RE = /(^>+([^\n]*?)(\n|$))+/m
                 QUOTES_CONTENT_RE = /^([> ]+)(.*)$/m
                 def block_textile_quotes( text )
                   text.gsub!( QUOTES_RE ) do |match|
                     lines = match.split( /\n/ )
                     quotes = ''
                     indent = 0
                     lines.each do |line|
                       line =~ QUOTES_CONTENT_RE
                       bq,content = $1, $2
                       l = bq.count('>')
                       if l != indent
                         quotes << ("\n\n" + (l>indent ? '<blockquote>' * (l-indent) : '</blockquote>' * (indent-l)) + "\n\n")
                         indent = l
                       end
                       quotes << (content + "\n")
                     end
                     quotes << ("\n" + '</blockquote>' * indent + "\n\n")
                     quotes
                   end
                 end
                 CODE_RE = /(\W)
                     @
                     (?:\|(\w+?)\|)?
                     (.+?)
                     @
                     (?=\W)/x
                 def inline_textile_code( text )
                     text.gsub!( CODE_RE ) do |m|
                         before,lang,code,after = $~[1..4]
                         lang = " lang=\"#{ lang }\"" if lang
                         rip_offtags( "#{ before }<code#{ lang }>#{ code }</code>#{ after }", false )
                     end
                 end
                 def lT( text )
                     text =~ /\#$/ ? 'o' : 'u'
                 end
                 def hard_break( text )
                     text.gsub!( /(.)\n(?!\Z| *([#*=]+(\s|$)|[{|]))/, "\\1<br />" ) if hard_breaks
                 end
                 BLOCKS_GROUP_RE = /\n{2,}(?! )/m
                 def blocks( text, deep_code = false )
                     text.replace( text.split( BLOCKS_GROUP_RE ).collect do |blk|
                         plain = blk !~ /\A[#*> ]/
                         # skip blocks that are complex HTML
                         if blk =~ /^<\/?(\w+).*>/ and not SIMPLE_HTML_TAGS.include? $1
                             blk
                         else
                             # search for indentation levels
                             blk.strip!
                             if blk.empty?
                                 blk
                             else
                                 code_blk = nil
                                 blk.gsub!( /((?:\n(?:\n^ +[^\n]*)+)+)/m ) do |iblk|
                                     flush_left iblk
                                     blocks iblk, plain
                                     iblk.gsub( /^(\S)/, "\t\\1" )
                                     if plain
                                         code_blk = iblk; ""
                                     else
                                         iblk
                                     end
                                 end
                                 block_applied = 0
                                 @rules.each do |rule_name|
                                     block_applied += 1 if ( rule_name.to_s.match /^block_/ and method( rule_name ).call( blk ) )
                                 end
                                 if block_applied.zero?
                                     if deep_code
                                         blk = "\t<pre><code>#{ blk }</code></pre>"
                                     else
                                         blk = "\t<p>#{ blk }</p>"
                                     end
                                 end
                                 # hard_break blk
                                 blk + "\n#{ code_blk }"
                             end
                         end
                     end.join( "\n\n" ) )
                 end
                 def textile_bq( tag, atts, cite, content )
                     cite, cite_title = check_refs( cite )
                     cite = " cite=\"#{ cite }\"" if cite
                     atts = shelve( atts ) if atts
                     "\t<blockquote#{ cite }>\n\t\t<p#{ atts }>#{ content }</p>\n\t</blockquote>"
                 end
                 def textile_p( tag, atts, cite, content )
                     atts = shelve( atts ) if atts
                     "\t<#{ tag }#{ atts }>#{ content }</#{ tag }>"
                 end
                 alias textile_h1 textile_p
                 alias textile_h2 textile_p
                 alias textile_h3 textile_p
                 alias textile_h4 textile_p
                 alias textile_h5 textile_p
                 alias textile_h6 textile_p
                 def textile_fn_( tag, num, atts, cite, content )
                     atts << " id=\"fn#{ num }\" class=\"footnote\""
                     content = "<sup>#{ num }</sup> #{ content }"
                     atts = shelve( atts ) if atts
                     "\t<p#{ atts }>#{ content }</p>"
                 end
                 BLOCK_RE = /^(([a-z]+)(\d*))(#{A}#{C})\.(?::(\S+))? (.*)$/m
                 def block_textile_prefix( text )
                     if text =~ BLOCK_RE
                         tag,tagpre,num,atts,cite,content = $~[1..6]
                         atts = pba( atts )
                         # pass to prefix handler
                         replacement = nil
                         if respond_to? "textile_#{ tag }", true
                           replacement = method( "textile_#{ tag }" ).call( tag, atts, cite, content )
                         elsif respond_to? "textile_#{ tagpre }_", true
                           replacement = method( "textile_#{ tagpre }_" ).call( tagpre, num, atts, cite, content )
                         end
                         text.gsub!( $& ) { replacement } if replacement
                     end
                 end
                 SETEXT_RE = /\A(.+?)\n([=-])[=-]* *$/m
                 def block_markdown_setext( text )
                     if text =~ SETEXT_RE
                         tag = if $2 == "="; "h1"; else; "h2"; end
                         blk, cont = "<#{ tag }>#{ $1 }</#{ tag }>", $'
                         blocks cont
                         text.replace( blk + cont )
                     end
                 end
                 ATX_RE = /\A(\#{1,6})  # $1 = string of #'s
                           [ ]*
                           (.+?)       # $2 = Header text
                           [ ]*
                           \#*         # optional closing #'s (not counted)
                           $/x
                 def block_markdown_atx( text )
                     if text =~ ATX_RE
                         tag = "h#{ $1.length }"
                         blk, cont = "<#{ tag }>#{ $2 }</#{ tag }>\n\n", $'
                         blocks cont
                         text.replace( blk + cont )
                     end
                 end
                 MARKDOWN_BQ_RE = /\A(^ *> ?.+$(.+\n)*\n*)+/m
                 def block_markdown_bq( text )
                     text.gsub!( MARKDOWN_BQ_RE ) do |blk|
                         blk.gsub!( /^ *> ?/, '' )
                         flush_left blk
                         blocks blk
                         blk.gsub!( /^(\S)/, "\t\\1" )
                         "<blockquote>\n#{ blk }\n</blockquote>\n\n"
                     end
                 end
                 MARKDOWN_RULE_RE = /^(#{
                     ['*', '-', '_'].collect { |ch| ' ?(' + Regexp::quote( ch ) + ' ?){3,}' }.join( '|' )
                 })$/
                 def block_markdown_rule( text )
                     text.gsub!( MARKDOWN_RULE_RE ) do |blk|
                         "<hr />"
                     end
                 end
                 # XXX TODO XXX
                 def block_markdown_lists( text )
                 end
                 def inline_textile_span( text )
                     QTAGS.each do |qtag_rc, ht, qtag_re, rtype|
                         text.gsub!( qtag_re ) do |m|
                             case rtype
                             when :limit
                                 sta,oqs,qtag,content,oqa = $~[1..6]
                                 atts = nil
                                 if content =~ /^(#{C})(.+)$/
                                   atts, content = $~[1..2]
                                 end
                             else
                                 qtag,atts,cite,content = $~[1..4]
                                 sta = ''
                             end
                             atts = pba( atts )
                             atts = shelve( atts ) if atts
                             "#{ sta }#{ oqs }<#{ ht }#{ atts }>#{ content }</#{ ht }>#{ oqa }"
                         end
                     end
                 end
                 LINK_RE = /
                         (
                         ([\s\[{(]|[#{PUNCT}])?     # $pre
                         "                          # start
                         (#{C})                     # $atts
                         ([^"\n]+?)                 # $text
                         \s?
                         (?:\(([^)]+?)\)(?="))?     # $title
                         ":
                         (                          # $url
                         (\/|[a-zA-Z]+:\/\/|www\.|mailto:)  # $proto
                         [[:alnum:]_\/]\S+?
                         )
                         (\/)?                      # $slash
                         ([^[:alnum:]_\=\/;\(\)]*?)         # $post
                         )
                         (?=<|\s|$)
                     /x
             #"
                 def inline_textile_link( text )
                     text.gsub!( LINK_RE ) do |m|
                       all,pre,atts,text,title,url,proto,slash,post = $~[1..9]
                       if text.include?('<br />')
                         all
                       else
                         url, url_title = check_refs( url )
                         title ||= url_title
                         # Idea below : an URL with unbalanced parethesis and
                         # ending by ')' is put into external parenthesis
                         if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                           url=url[0..-2] # discard closing parenth from url
                           post = ")"+post # add closing parenth to post
                         end
                         atts = pba( atts )
                         atts = " href=\"#{ htmlesc url }#{ slash }\"#{ atts }"
                         atts << " title=\"#{ htmlesc title }\"" if title
                         atts = shelve( atts ) if atts
                         external = (url =~ /^https?:\/\//) ? ' class="external"' : ''
                         "#{ pre }<a#{ atts }#{ external }>#{ text }</a>#{ post }"
                       end
                     end
                 end
                 MARKDOWN_REFLINK_RE = /
                         \[([^\[\]]+)\]      # $text
                         [ ]?                # opt. space
                         (?:\n[ ]*)?         # one optional newline followed by spaces
                         \[(.*?)\]           # $id
                     /x
                 def inline_markdown_reflink( text )
                     text.gsub!( MARKDOWN_REFLINK_RE ) do |m|
                         text, id = $~[1..2]
                         if id.empty?
                             url, title = check_refs( text )
                         else
                             url, title = check_refs( id )
                         end
                         atts = " href=\"#{ url }\""
                         atts << " title=\"#{ title }\"" if title
                         atts = shelve( atts )
                         "<a#{ atts }>#{ text }</a>"
                     end
                 end
                 MARKDOWN_LINK_RE = /
                         \[([^\[\]]+)\]      # $text
                         \(                  # open paren
                         [ \t]*              # opt space
                         <?(.+?)>?           # $href
                         [ \t]*              # opt space
                         (?:                 # whole title
                         (['"])              # $quote
                         (.*?)               # $title
                         \3                  # matching quote
                         )?                  # title is optional
                         \)
                     /x
                 def inline_markdown_link( text )
                     text.gsub!( MARKDOWN_LINK_RE ) do |m|
                         text, url, quote, title = $~[1..4]
                         atts = " href=\"#{ url }\""
                         atts << " title=\"#{ title }\"" if title
                         atts = shelve( atts )
                         "<a#{ atts }>#{ text }</a>"
                     end
                 end
                 TEXTILE_REFS_RE =  /(^ *)\[([^\[\n]+?)\](#{HYPERLINK})(?=\s|$)/
                 MARKDOWN_REFS_RE = /(^ *)\[([^\n]+?)\]:\s+<?(#{HYPERLINK})>?(?:\s+"((?:[^"]|\\")+)")?(?=\s|$)/m
                 def refs( text )
                     @rules.each do |rule_name|
                         method( rule_name ).call( text ) if rule_name.to_s.match /^refs_/
                     end
                 end
                 def refs_textile( text )
                     text.gsub!( TEXTILE_REFS_RE ) do |m|
                         flag, url = $~[2..3]
                         @urlrefs[flag.downcase] = [url, nil]
                         nil
                     end
                 end
                 def refs_markdown( text )
                     text.gsub!( MARKDOWN_REFS_RE ) do |m|
                         flag, url = $~[2..3]
                         title = $~[6]
                         @urlrefs[flag.downcase] = [url, title]
                         nil
                     end
                 end
                 def check_refs( text )
                     ret = @urlrefs[text.downcase] if text
                     ret || [text, nil]
                 end
                 IMAGE_RE = /
                         (>|\s|^)           # start of line?
                         \!                   # opening
                         (\<|\=|\>)?          # optional alignment atts
                         (#{C})               # optional style,class atts
                         (?:\. )?             # optional dot-space
                         ([^\s(!]+?)          # presume this is the src
                         \s?                  # optional space
                         (?:\(((?:[^\(\)]|\([^\)]+\))+?)\))?   # optional title
                         \!                   # closing
                         (?::#{ HYPERLINK })? # optional href
                     /x
                 def inline_textile_image( text )
                     text.gsub!( IMAGE_RE )  do |m|
                         stln,algn,atts,url,title,href,href_a1,href_a2 = $~[1..8]
                         htmlesc title
                         atts = pba( atts )
                         atts = " src=\"#{ htmlesc url.dup }\"#{ atts }"
                         atts << " title=\"#{ title }\"" if title
                         atts << " alt=\"#{ title }\""
                         # size = @getimagesize($url);
                         # if($size) $atts.= " $size[3]";
                         href, alt_title = check_refs( href ) if href
                         url, url_title = check_refs( url )
+                        return m unless uri_with_safe_scheme?(url)
                         out = ''
                         out << "<a#{ shelve( " href=\"#{ href }\"" ) }>" if href
                         out << "<img#{ shelve( atts ) } />"
                         out << "</a>#{ href_a1 }#{ href_a2 }" if href
                         if algn
                             algn = h_align( algn )
                             if stln == "<p>"
                                 out = "<p style=\"float:#{ algn }\">#{ out }"
                             else
                                 out = "#{ stln }<div style=\"float:#{ algn }\">#{ out }</div>"
                             end
                         else
                             out = stln + out
                         end
                         out
                     end
                 end
                 def shelve( val )
                     @shelf << val
                     " :redsh##{ @shelf.length }:"
                 end
                 def retrieve( text )
                     text.gsub!(/ :redsh#(\d+):/) do
                       @shelf[$1.to_i - 1] || $&
                     end
                 end
                 def incoming_entities( text )
                     ## turn any incoming ampersands into a dummy character for now.
                     ## This uses a negative lookahead for alphanumerics followed by a semicolon,
                     ## implying an incoming html entity, to be skipped
                     text.gsub!( /&(?![#a-z0-9]+;)/i, "x%x%" )
                 end
                 def no_textile( text )
                     text.gsub!( /(^|\s)==([^=]+.*?)==(\s|$)?/,
                         '\1<notextile>\2</notextile>\3' )
                     text.gsub!( /^ *==([^=]+.*?)==/m,
                         '\1<notextile>\2</notextile>\3' )
                 end
                 def clean_white_space( text )
                     # normalize line breaks
                     text.gsub!( /\r\n/, "\n" )
                     text.gsub!( /\r/, "\n" )
                     text.gsub!( /\t/, '    ' )
                     text.gsub!( /^ +$/, '' )
                     text.gsub!( /\n{3,}/, "\n\n" )
                     text.gsub!( /"$/, "\" " )
                     # if entire document is indented, flush
                     # to the left side
                     flush_left text
                 end
                 def flush_left( text )
                     indt = 0
                     if text =~ /^ /
                         while text !~ /^ {#{indt}}\S/
                             indt += 1
                         end unless text.empty?
                         if indt.nonzero?
                             text.gsub!( /^ {#{indt}}/, '' )
                         end
                     end
                 end
                 def footnote_ref( text )
                     text.gsub!( /\b\[([0-9]+?)\](\s)?/,
                         '<sup><a href="#fn\1">\1</a></sup>\2' )
                 end
                 OFFTAGS = /(code|pre|kbd|notextile)/
                 OFFTAG_MATCH = /(?:(<\/#{ OFFTAGS }>)|(<#{ OFFTAGS }[^>]*>))(.*?)(?=<\/?#{ OFFTAGS }\W|\Z)/mi
                 OFFTAG_OPEN = /<#{ OFFTAGS }/
                 OFFTAG_CLOSE = /<\/?#{ OFFTAGS }/
                 HASTAG_MATCH = /(<\/?\w[^\n]*?>)/m
                 ALLTAG_MATCH = /(<\/?\w[^\n]*?>)|.*?(?=<\/?\w[^\n]*?>|$)/m
                 def glyphs_textile( text, level = 0 )
                     if text !~ HASTAG_MATCH
                         pgl text
                         footnote_ref text
                     else
                         codepre = 0
                         text.gsub!( ALLTAG_MATCH ) do |line|
                             ## matches are off if we're between <code>, <pre> etc.
                             if $1
                                 if line =~ OFFTAG_OPEN
                                     codepre += 1
                                 elsif line =~ OFFTAG_CLOSE
                                     codepre -= 1
                                     codepre = 0 if codepre < 0
                                 end
                             elsif codepre.zero?
                                 glyphs_textile( line, level + 1 )
                             else
                                 htmlesc( line, :NoQuotes )
                             end
                             # p [level, codepre, line]
                             line
                         end
                     end
                 end
                 def rip_offtags( text, escape_aftertag=true, escape_line=true )
                     if text =~ /<.*>/
                         ## strip and encode <pre> content
                         codepre, used_offtags = 0, {}
                         text.gsub!( OFFTAG_MATCH ) do |line|
                             if $3
                                 first, offtag, aftertag = $3, $4, $5
                                 codepre += 1
                                 used_offtags[offtag] = true
                                 if codepre - used_offtags.length > 0
                                     htmlesc( line, :NoQuotes ) if escape_line
                                     @pre_list.last << line
                                     line = ""
                                 else
                                     ### htmlesc is disabled between CODE tags which will be parsed with highlighter
                                     ### Regexp in formatter.rb is : /<code\s+class="(\w+)">\s?(.+)/m
                                     ### NB: some changes were made not to use $N variables, because we use "match"
                                     ###   and it breaks following lines
                                     htmlesc( aftertag, :NoQuotes ) if aftertag && escape_aftertag && !first.match(/<code\s+class="(\w+)">/)
                                     line = "<redpre##{ @pre_list.length }>"
                                     first.match(/<#{ OFFTAGS }([^>]*)>/)
                                     tag = $1
                                     $2.to_s.match(/(class\=("[^"]+"|'[^']+'))/i)
                                     tag << " #{$1}" if $1
                                     @pre_list << "<#{ tag }>#{ aftertag }"
                                 end
                             elsif $1 and codepre > 0
                                 if codepre - used_offtags.length > 0
                                     htmlesc( line, :NoQuotes ) if escape_line
                                     @pre_list.last << line
                                     line = ""
                                 end
                                 codepre -= 1 unless codepre.zero?
                                 used_offtags = {} if codepre.zero?
                             end
                             line
                         end
                     end
                     text
                 end
                 def smooth_offtags( text )
                     unless @pre_list.empty?
                         ## replace <pre> content
                         text.gsub!( /<redpre#(\d+)>/ ) { @pre_list[$1.to_i] }
                     end
                 end
                 def inline( text )
                     [/^inline_/, /^glyphs_/].each do |meth_re|
                         @rules.each do |rule_name|
                             method( rule_name ).call( text ) if rule_name.to_s.match( meth_re )
                         end
                     end
                 end
                 def h_align( text )
                     H_ALGN_VALS[text]
                 end
                 def v_align( text )
                     V_ALGN_VALS[text]
                 end
                 def textile_popup_help( name, windowW, windowH )
                     ' <a target="_blank" href="http://hobix.com/textile/#' + helpvar + '" onclick="window.open(this.href, \'popupwindow\', \'width=' + windowW + ',height=' + windowH + ',scrollbars,resizable\'); return false;">' + name + '</a><br />'
                 end
                 # HTML cleansing stuff
                 BASIC_TAGS = {
                     'a' => ['href', 'title'],
                     'img' => ['src', 'alt', 'title'],
                     'br' => [],
                     'i' => nil,
                     'u' => nil,
                     'b' => nil,
                     'pre' => nil,
                     'kbd' => nil,
                     'code' => ['lang'],
                     'cite' => nil,
                     'strong' => nil,
                     'em' => nil,
                     'ins' => nil,
                     'sup' => nil,
                     'sub' => nil,
                     'del' => nil,
                     'table' => nil,
                     'tr' => nil,
                     'td' => ['colspan', 'rowspan'],
                     'th' => nil,
                     'ol' => nil,
                     'ul' => nil,
                     'li' => nil,
                     'p' => nil,
                     'h1' => nil,
                     'h2' => nil,
                     'h3' => nil,
                     'h4' => nil,
                     'h5' => nil,
                     'h6' => nil,
                     'blockquote' => ['cite']
                 }
                 def clean_html( text, tags = BASIC_TAGS )
                     text.gsub!( /<!\[CDATA\[/, '' )
                     text.gsub!( /<(\/*)(\w+)([^>]*)>/ ) do
                         raw = $~
                         tag = raw[2].downcase
                         if tags.has_key? tag
                             pcs = [tag]
                             tags[tag].each do |prop|
                                 ['"', "'", ''].each do |q|
                                     q2 = ( q != '' ? q : '\s' )
                                     if raw[3] =~ /#{prop}\s*=\s*#{q}([^#{q2}]+)#{q}/i
                                         attrv = $1
                                         next if prop == 'src' and attrv =~ %r{^(?!http)\w+:}
                                         pcs << "#{prop}=\"#{$1.gsub('"', '\\"')}\""
                                         break
                                     end
                                 end
                             end if tags[tag]
                             "<#{raw[1]}#{pcs.join " "}>"
                         else
                             " "
                         end
                     end
                 end
                 ALLOWED_TAGS = %w(redpre pre code notextile)
                 def escape_html_tags(text)
                   text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) {|m| ALLOWED_TAGS.include?($2) ? "<#{$1}#{$3}" : "&lt;#{$1}#{'&gt;' unless $3.blank?}" }
                 end
             end

lib/redmine/field_format.rb +15 -2

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             module Redmine
               module FieldFormat
                 def self.add(name, klass)
                   all[name.to_s] = klass.instance
                 end
                 def self.delete(name)
                   all.delete(name.to_s)
                 end
                 def self.all
                   @formats ||= Hash.new(Base.instance)
                 end
                 def self.available_formats
                   all.keys
                 end
                 def self.find(name)
                   all[name.to_s]
                 end
                 # Return an array of custom field formats which can be used in select_tag
                 def self.as_select(class_name=nil)
                   formats = all.values.select do |format|
                     format.class.customized_class_names.nil? || format.class.customized_class_names.include?(class_name)
                   end
                   formats.map {|format| [::I18n.t(format.label), format.name] }.sort_by(&:first)
                 end
                 class Base
                   include Singleton
                   include Redmine::I18n
+                  include Redmine::Helpers::URL
                   include ERB::Util
                   class_attribute :format_name
                   self.format_name = nil
                   # Set this to true if the format supports multiple values
                   class_attribute :multiple_supported
                   self.multiple_supported = false
                   # Set this to true if the format supports textual search on custom values
                   class_attribute :searchable_supported
                   self.searchable_supported = false
                   # Set this to true if field values can be summed up
                   class_attribute :totalable_supported
                   self.totalable_supported = false
                   # Restricts the classes that the custom field can be added to
                   # Set to nil for no restrictions
                   class_attribute :customized_class_names
                   self.customized_class_names = nil
                   # Name of the partial for editing the custom field
                   class_attribute :form_partial
                   self.form_partial = nil
                   class_attribute :change_as_diff
                   self.change_as_diff = false
                   def self.add(name)
                     self.format_name = name
                     Redmine::FieldFormat.add(name, self)
                   end
                   private_class_method :add
                   def self.field_attributes(*args)
                     CustomField.store_accessor :format_store, *args
                   end
                   field_attributes :url_pattern
                   def name
                     self.class.format_name
                   end
                   def label
                     "label_#{name}"
                   end
                   def cast_custom_value(custom_value)
                     cast_value(custom_value.custom_field, custom_value.value, custom_value.customized)
                   end
                   def cast_value(custom_field, value, customized=nil)
                     if value.blank?
                       nil
                     elsif value.is_a?(Array)
                       casted = value.map do |v|
                         cast_single_value(custom_field, v, customized)
                       end
                       casted.compact.sort
                     else
                       cast_single_value(custom_field, value, customized)
                     end
                   end
                   def cast_single_value(custom_field, value, customized=nil)
                     value.to_s
                   end
                   def target_class
                     nil
                   end
                   def possible_custom_value_options(custom_value)
                     possible_values_options(custom_value.custom_field, custom_value.customized)
                   end
                   def possible_values_options(custom_field, object=nil)
                     []
                   end
                   def value_from_keyword(custom_field, keyword, object)
                     possible_values_options = possible_values_options(custom_field, object)
                     if possible_values_options.present?
                       keyword = keyword.to_s
                       if v = possible_values_options.detect {|text, id| keyword.casecmp(text)  == 0}
                         if v.is_a?(Array)
                           v.last
                         else
                           v
                         end
                       end
                     else
                       keyword
                     end
                   end
                   # Returns the validation errors for custom_field
                   # Should return an empty array if custom_field is valid
                   def validate_custom_field(custom_field)
-                    []
+                    errors = []
+                    pattern = custom_field.url_pattern
+                    if pattern.present? && !uri_with_safe_scheme?(url_pattern_without_tokens(pattern))
+                      errors << [:url_pattern, :invalid]
+                    end
+                    errors
                   end
                   # Returns the validation error messages for custom_value
                   # Should return an empty array if custom_value is valid
                   def validate_custom_value(custom_value)
                     values = Array.wrap(custom_value.value).reject {|value| value.to_s == ''}
                     errors = values.map do |value|
                       validate_single_value(custom_value.custom_field, value, custom_value.customized)
                     end
                     errors.flatten.uniq
                   end
                   def validate_single_value(custom_field, value, customized=nil)
                     []
                   end
                   def formatted_custom_value(view, custom_value, html=false)
                     formatted_value(view, custom_value.custom_field, custom_value.value, custom_value.customized, html)
                   end
                   def formatted_value(view, custom_field, value, customized=nil, html=false)
                     casted = cast_value(custom_field, value, customized)
                     if html && custom_field.url_pattern.present?
                       texts_and_urls = Array.wrap(casted).map do |single_value|
                         text = view.format_object(single_value, false).to_s
                         url = url_from_pattern(custom_field, single_value, customized)
                         [text, url]
                       end
-                      links = texts_and_urls.sort_by(&:first).map {|text, url| view.link_to text, url}
+                      links = texts_and_urls.sort_by(&:first).map {|text, url| view.link_to_if uri_with_safe_scheme?(url), text, url}
                       links.join(', ').html_safe
                     else
                       casted
                     end
                   end
                   # Returns an URL generated with the custom field URL pattern
                   # and variables substitution:
                   # %value% => the custom field value
                   # %id% => id of the customized object
                   # %project_id% => id of the project of the customized object if defined
                   # %project_identifier% => identifier of the project of the customized object if defined
                   # %m1%, %m2%... => capture groups matches of the custom field regexp if defined
                   def url_from_pattern(custom_field, value, customized)
                     url = custom_field.url_pattern.to_s.dup
                     url.gsub!('%value%') {value.to_s}
                     url.gsub!('%id%') {customized.id.to_s}
                     url.gsub!('%project_id%') {(customized.respond_to?(:project) ? customized.project.try(:id) : nil).to_s}
                     url.gsub!('%project_identifier%') {(customized.respond_to?(:project) ? customized.project.try(:identifier) : nil).to_s}
                     if custom_field.regexp.present?
                       url.gsub!(%r{%m(\d+)%}) do
                         m = $1.to_i
                         if matches ||= value.to_s.match(Regexp.new(custom_field.regexp))
                           matches[m].to_s
                         end
                       end
                     end
                     url
                   end
                   protected :url_from_pattern
+                  # Returns the URL pattern with substitution tokens removed,
+                  # for validation purpose
+                  def url_pattern_without_tokens(url_pattern)
+                    url_pattern.to_s.gsub(/%(value|id|project_id|project_identifier|m\d+)%/, '')
+                  end
+                  protected :url_pattern_without_tokens
                   def edit_tag(view, tag_id, tag_name, custom_value, options={})
                     view.text_field_tag(tag_name, custom_value.value, options.merge(:id => tag_id))
                   end
                   def bulk_edit_tag(view, tag_id, tag_name, custom_field, objects, value, options={})
                     view.text_field_tag(tag_name, value, options.merge(:id => tag_id)) +
                       bulk_clear_tag(view, tag_id, tag_name, custom_field, value)
                   end
                   def bulk_clear_tag(view, tag_id, tag_name, custom_field, value)
                     if custom_field.is_required?
                       ''.html_safe
                     else
                       view.content_tag('label',
                         view.check_box_tag(tag_name, '__none__', (value == '__none__'), :id => nil, :data => {:disables => "##{tag_id}"}) + l(:button_clear),
                         :class => 'inline'
                       )
                     end
                   end
                   protected :bulk_clear_tag
                   def query_filter_options(custom_field, query)
                     {:type => :string}
                   end
                   def before_custom_field_save(custom_field)
                   end
                   # Returns a ORDER BY clause that can used to sort customized
                   # objects by their value of the custom field.
                   # Returns nil if the custom field can not be used for sorting.
                   def order_statement(custom_field)
                     # COALESCE is here to make sure that blank and NULL values are sorted equally
                     "COALESCE(#{join_alias custom_field}.value, '')"
                   end
                   # Returns a GROUP BY clause that can used to group by custom value
                   # Returns nil if the custom field can not be used for grouping.
                   def group_statement(custom_field)
                     nil
                   end
                   # Returns a JOIN clause that is added to the query when sorting by custom values
                   def join_for_order_statement(custom_field)
                     alias_name = join_alias(custom_field)
                     "LEFT OUTER JOIN #{CustomValue.table_name} #{alias_name}" +
                       " ON #{alias_name}.customized_type = '#{custom_field.class.customized_class.base_class.name}'" +
                       " AND #{alias_name}.customized_id = #{custom_field.class.customized_class.table_name}.id" +
                       " AND #{alias_name}.custom_field_id = #{custom_field.id}" +
                       " AND (#{custom_field.visibility_by_project_condition})" +
                       " AND #{alias_name}.value <> ''" +
                       " AND #{alias_name}.id = (SELECT max(#{alias_name}_2.id) FROM #{CustomValue.table_name} #{alias_name}_2" +
                         " WHERE #{alias_name}_2.customized_type = #{alias_name}.customized_type" +
                         " AND #{alias_name}_2.customized_id = #{alias_name}.customized_id" +
                         " AND #{alias_name}_2.custom_field_id = #{alias_name}.custom_field_id)"
                   end
                   def join_alias(custom_field)
                     "cf_#{custom_field.id}"
                   end
                   protected :join_alias
                 end
                 class Unbounded < Base
                   def validate_single_value(custom_field, value, customized=nil)
                     errs = super
                     value = value.to_s
                     unless custom_field.regexp.blank? or value =~ Regexp.new(custom_field.regexp)
                       errs << ::I18n.t('activerecord.errors.messages.invalid')
                     end
                     if custom_field.min_length && value.length < custom_field.min_length
                       errs << ::I18n.t('activerecord.errors.messages.too_short', :count => custom_field.min_length)
                     end
                     if custom_field.max_length && custom_field.max_length > 0 && value.length > custom_field.max_length
                       errs << ::I18n.t('activerecord.errors.messages.too_long', :count => custom_field.max_length)
                     end
                     errs
                   end
                 end
                 class StringFormat < Unbounded
                   add 'string'
                   self.searchable_supported = true
                   self.form_partial = 'custom_fields/formats/string'
                   field_attributes :text_formatting
                   def formatted_value(view, custom_field, value, customized=nil, html=false)
                     if html
                       if custom_field.url_pattern.present?
                         super
                       elsif custom_field.text_formatting == 'full'
                         view.textilizable(value, :object => customized)
                       else
                         value.to_s
                       end
                     else
                       value.to_s
                     end
                   end
                 end
                 class TextFormat < Unbounded
                   add 'text'
                   self.searchable_supported = true
                   self.form_partial = 'custom_fields/formats/text'
                   self.change_as_diff = true
                   def formatted_value(view, custom_field, value, customized=nil, html=false)
                     if html
                       if value.present?
                         if custom_field.text_formatting == 'full'
                           view.textilizable(value, :object => customized)
                         else
                           view.simple_format(html_escape(value))
                         end
                       else
                         ''
                       end
                     else
                       value.to_s
                     end
                   end
                   def edit_tag(view, tag_id, tag_name, custom_value, options={})
                     view.text_area_tag(tag_name, custom_value.value, options.merge(:id => tag_id, :rows => 3))
                   end
                   def bulk_edit_tag(view, tag_id, tag_name, custom_field, objects, value, options={})
                     view.text_area_tag(tag_name, value, options.merge(:id => tag_id, :rows => 3)) +
                       '<br />'.html_safe +
                       bulk_clear_tag(view, tag_id, tag_name, custom_field, value)
                   end
                   def query_filter_options(custom_field, query)
                     {:type => :text}
                   end
                 end
                 class LinkFormat < StringFormat
                   add 'link'
                   self.searchable_supported = false
                   self.form_partial = 'custom_fields/formats/link'
                   def formatted_value(view, custom_field, value, customized=nil, html=false)
                     if html && value.present?
                       if custom_field.url_pattern.present?
                         url = url_from_pattern(custom_field, value, customized)
                       else
                         url = value.to_s
                         unless url =~ %r{\A[a-z]+://}i
                           # no protocol found, use http by default
                           url = "http://" + url
                         end
                       end
                       view.link_to value.to_s.truncate(40), url
                     else
                       value.to_s
                     end
                   end
                 end
                 class Numeric < Unbounded
                   self.form_partial = 'custom_fields/formats/numeric'
                   self.totalable_supported = true
                   def order_statement(custom_field)
                     # Make the database cast values into numeric
                     # Postgresql will raise an error if a value can not be casted!
                     # CustomValue validations should ensure that it doesn't occur
                     "CAST(CASE #{join_alias custom_field}.value WHEN '' THEN '0' ELSE #{join_alias custom_field}.value END AS decimal(30,3))"
                   end
                   # Returns totals for the given scope
                   def total_for_scope(custom_field, scope)
                     scope.joins(:custom_values).
                       where(:custom_values => {:custom_field_id => custom_field.id}).
                       where.not(:custom_values => {:value => ''}).
                       sum("CAST(#{CustomValue.table_name}.value AS decimal(30,3))")
                   end
                   def cast_total_value(custom_field, value)
                     cast_single_value(custom_field, value)
                   end
                 end
                 class IntFormat < Numeric
                   add 'int'
                   def label
                     "label_integer"
                   end
                   def cast_single_value(custom_field, value, customized=nil)
                     value.to_i
                   end
                   def validate_single_value(custom_field, value, customized=nil)
                     errs = super
                     errs << ::I18n.t('activerecord.errors.messages.not_a_number') unless value.to_s =~ /^[+-]?\d+$/
                     errs
                   end
                   def query_filter_options(custom_field, query)
                     {:type => :integer}
                   end
                   def group_statement(custom_field)
                     order_statement(custom_field)
                   end
                 end
                 class FloatFormat < Numeric
                   add 'float'
                   def cast_single_value(custom_field, value, customized=nil)
                     value.to_f
                   end
                   def cast_total_value(custom_field, value)
                     value.to_f.round(2)
                   end
                   def validate_single_value(custom_field, value, customized=nil)
                     errs = super
                     errs << ::I18n.t('activerecord.errors.messages.invalid') unless (Kernel.Float(value) rescue nil)
                     errs
                   end
                   def query_filter_options(custom_field, query)
                     {:type => :float}
                   end
                 end
                 class DateFormat < Unbounded
                   add 'date'
                   self.form_partial = 'custom_fields/formats/date'
                   def cast_single_value(custom_field, value, customized=nil)
                     value.to_date rescue nil
                   end
                   def validate_single_value(custom_field, value, customized=nil)
                     if value =~ /^\d{4}-\d{2}-\d{2}$/ && (value.to_date rescue false)
                       []
                     else
                       [::I18n.t('activerecord.errors.messages.not_a_date')]
                     end
                   end
                   def edit_tag(view, tag_id, tag_name, custom_value, options={})
                     view.date_field_tag(tag_name, custom_value.value, options.merge(:id => tag_id, :size => 10)) +
                       view.calendar_for(tag_id)
                   end
                   def bulk_edit_tag(view, tag_id, tag_name, custom_field, objects, value, options={})
                     view.date_field_tag(tag_name, value, options.merge(:id => tag_id, :size => 10)) +
                       view.calendar_for(tag_id) +
                       bulk_clear_tag(view, tag_id, tag_name, custom_field, value)
                   end
                   def query_filter_options(custom_field, query)
                     {:type => :date}
                   end
                   def group_statement(custom_field)
                     order_statement(custom_field)
                   end
                 end
                 class List < Base
                   self.multiple_supported = true
                   field_attributes :edit_tag_style
                   def edit_tag(view, tag_id, tag_name, custom_value, options={})
                     if custom_value.custom_field.edit_tag_style == 'check_box'
                       check_box_edit_tag(view, tag_id, tag_name, custom_value, options)
                     else
                       select_edit_tag(view, tag_id, tag_name, custom_value, options)
                     end
                   end
                   def bulk_edit_tag(view, tag_id, tag_name, custom_field, objects, value, options={})
                     opts = []
                     opts << [l(:label_no_change_option), ''] unless custom_field.multiple?
                     opts << [l(:label_none), '__none__'] unless custom_field.is_required?
                     opts += possible_values_options(custom_field, objects)
                     view.select_tag(tag_name, view.options_for_select(opts, value), options.merge(:multiple => custom_field.multiple?))
                   end
                   def query_filter_options(custom_field, query)
                     {:type => :list_optional, :values => query_filter_values(custom_field, query)}
                   end
                   protected
                   # Returns the values that are available in the field filter
                   def query_filter_values(custom_field, query)
                     possible_values_options(custom_field, query.project)
                   end
                   # Renders the edit tag as a select tag
                   def select_edit_tag(view, tag_id, tag_name, custom_value, options={})
                     blank_option = ''.html_safe
                     unless custom_value.custom_field.multiple?
                       if custom_value.custom_field.is_required?
                         unless custom_value.custom_field.default_value.present?
                           blank_option = view.content_tag('option', "--- #{l(:actionview_instancetag_blank_option)} ---", :value => '')
                         end
                       else
                         blank_option = view.content_tag('option', '&nbsp;'.html_safe, :value => '')
                       end
                     end
                     options_tags = blank_option + view.options_for_select(possible_custom_value_options(custom_value), custom_value.value)
                     s = view.select_tag(tag_name, options_tags, options.merge(:id => tag_id, :multiple => custom_value.custom_field.multiple?))
                     if custom_value.custom_field.multiple?
                       s << view.hidden_field_tag(tag_name, '')
                     end
                     s
                   end
                   # Renders the edit tag as check box or radio tags
                   def check_box_edit_tag(view, tag_id, tag_name, custom_value, options={})
                     opts = []
                     unless custom_value.custom_field.multiple? || custom_value.custom_field.is_required?
                       opts << ["(#{l(:label_none)})", '']
                     end
                     opts += possible_custom_value_options(custom_value)
                     s = ''.html_safe
                     tag_method = custom_value.custom_field.multiple? ? :check_box_tag : :radio_button_tag
                     opts.each do |label, value|
                       value ||= label
                       checked = (custom_value.value.is_a?(Array) && custom_value.value.include?(value)) || custom_value.value.to_s == value
                       tag = view.send(tag_method, tag_name, value, checked, :id => tag_id)
                       # set the id on the first tag only
                       tag_id = nil
                       s << view.content_tag('label', tag + ' ' + label)
                     end
                     if custom_value.custom_field.multiple?
                       s << view.hidden_field_tag(tag_name, '')
                     end
                     css = "#{options[:class]} check_box_group"
                     view.content_tag('span', s, options.merge(:class => css))
                   end
                 end
                 class ListFormat < List
                   add 'list'
                   self.searchable_supported = true
                   self.form_partial = 'custom_fields/formats/list'
                   def possible_custom_value_options(custom_value)
                     options = possible_values_options(custom_value.custom_field)
                     missing = [custom_value.value].flatten.reject(&:blank?) - options
                     if missing.any?
                       options += missing
                     end
                     options
                   end
                   def possible_values_options(custom_field, object=nil)
                     custom_field.possible_values
                   end
                   def validate_custom_field(custom_field)
                     errors = []
                     errors << [:possible_values, :blank] if custom_field.possible_values.blank?
                     errors << [:possible_values, :invalid] unless custom_field.possible_values.is_a? Array
                     errors
                   end
                   def validate_custom_value(custom_value)
                     values = Array.wrap(custom_value.value).reject {|value| value.to_s == ''}
                     invalid_values = values - Array.wrap(custom_value.value_was) - custom_value.custom_field.possible_values
                     if invalid_values.any?
                       [::I18n.t('activerecord.errors.messages.inclusion')]
                     else
                       []
                     end
                   end
                   def group_statement(custom_field)
                     order_statement(custom_field)
                   end
                 end
                 class BoolFormat < List
                   add 'bool'
                   self.multiple_supported = false
                   self.form_partial = 'custom_fields/formats/bool'
                   def label
                     "label_boolean"
                   end
                   def cast_single_value(custom_field, value, customized=nil)
                     value == '1' ? true : false
                   end
                   def possible_values_options(custom_field, object=nil)
                     [[::I18n.t(:general_text_Yes), '1'], [::I18n.t(:general_text_No), '0']]
                   end
                   def group_statement(custom_field)
                     order_statement(custom_field)
                   end
                   def edit_tag(view, tag_id, tag_name, custom_value, options={})
                     case custom_value.custom_field.edit_tag_style
                     when 'check_box'
                       single_check_box_edit_tag(view, tag_id, tag_name, custom_value, options)
                     when 'radio'
                       check_box_edit_tag(view, tag_id, tag_name, custom_value, options)
                     else
                       select_edit_tag(view, tag_id, tag_name, custom_value, options)
                     end
                   end
                   # Renders the edit tag as a simple check box
                   def single_check_box_edit_tag(view, tag_id, tag_name, custom_value, options={})
                     s = ''.html_safe
                     s << view.hidden_field_tag(tag_name, '0', :id => nil)
                     s << view.check_box_tag(tag_name, '1', custom_value.value.to_s == '1', :id => tag_id)
                     view.content_tag('span', s, options)
                   end
                 end
                 class RecordList < List
                   self.customized_class_names = %w(Issue TimeEntry Version Document Project)
                   def cast_single_value(custom_field, value, customized=nil)
                     target_class.find_by_id(value.to_i) if value.present?
                   end
                   def target_class
                     @target_class ||= self.class.name[/^(.*::)?(.+)Format$/, 2].constantize rescue nil
                   end
                   def reset_target_class
                     @target_class = nil
                   end
                   def possible_custom_value_options(custom_value)
                     options = possible_values_options(custom_value.custom_field, custom_value.customized)
                     missing = [custom_value.value_was].flatten.reject(&:blank?) - options.map(&:last)
                     if missing.any?
                       options += target_class.where(:id => missing.map(&:to_i)).map {|o| [o.to_s, o.id.to_s]}
                     end
                     options
                   end
                   def order_statement(custom_field)
                     if target_class.respond_to?(:fields_for_order_statement)
                       target_class.fields_for_order_statement(value_join_alias(custom_field))
                     end
                   end
                   def group_statement(custom_field)
                     "COALESCE(#{join_alias custom_field}.value, '')"
                   end
                   def join_for_order_statement(custom_field)
                     alias_name = join_alias(custom_field)
                     "LEFT OUTER JOIN #{CustomValue.table_name} #{alias_name}" +
                       " ON #{alias_name}.customized_type = '#{custom_field.class.customized_class.base_class.name}'" +
                       " AND #{alias_name}.customized_id = #{custom_field.class.customized_class.table_name}.id" +
                       " AND #{alias_name}.custom_field_id = #{custom_field.id}" +
                       " AND (#{custom_field.visibility_by_project_condition})" +
                       " AND #{alias_name}.value <> ''" +
                       " AND #{alias_name}.id = (SELECT max(#{alias_name}_2.id) FROM #{CustomValue.table_name} #{alias_name}_2" +
                         " WHERE #{alias_name}_2.customized_type = #{alias_name}.customized_type" +
                         " AND #{alias_name}_2.customized_id = #{alias_name}.customized_id" +
                         " AND #{alias_name}_2.custom_field_id = #{alias_name}.custom_field_id)" +
                       " LEFT OUTER JOIN #{target_class.table_name} #{value_join_alias custom_field}" +
                       " ON CAST(CASE #{alias_name}.value WHEN '' THEN '0' ELSE #{alias_name}.value END AS decimal(30,0)) = #{value_join_alias custom_field}.id"
                   end
                   def value_join_alias(custom_field)
                     join_alias(custom_field) + "_" + custom_field.field_format
                   end
                   protected :value_join_alias
                 end
                 class EnumerationFormat < RecordList
                   add 'enumeration'
                   self.form_partial = 'custom_fields/formats/enumeration'
                   def label
                     "label_field_format_enumeration"
                   end
                   def target_class
                     @target_class ||= CustomFieldEnumeration
                   end
                   def possible_values_options(custom_field, object=nil)
                     possible_values_records(custom_field, object).map {|u| [u.name, u.id.to_s]}
                   end
                   def possible_values_records(custom_field, object=nil)
                     custom_field.enumerations.active
                   end
                   def value_from_keyword(custom_field, keyword, object)
                     value = custom_field.enumerations.where("LOWER(name) LIKE LOWER(?)", keyword).first
                     value ? value.id : nil
                   end
                 end
                 class UserFormat < RecordList
                   add 'user'
                   self.form_partial = 'custom_fields/formats/user'
                   field_attributes :user_role
                   def possible_values_options(custom_field, object=nil)
                     possible_values_records(custom_field, object).map {|u| [u.name, u.id.to_s]}
                   end
                   def possible_values_records(custom_field, object=nil)
                     if object.is_a?(Array)
                       projects = object.map {|o| o.respond_to?(:project) ? o.project : nil}.compact.uniq
                       projects.map {|project| possible_values_records(custom_field, project)}.reduce(:&) || []
                     elsif object.respond_to?(:project) && object.project
                       scope = object.project.users
                       if custom_field.user_role.is_a?(Array)
                         role_ids = custom_field.user_role.map(&:to_s).reject(&:blank?).map(&:to_i)
                         if role_ids.any?
                           scope = scope.where("#{Member.table_name}.id IN (SELECT DISTINCT member_id FROM #{MemberRole.table_name} WHERE role_id IN (?))", role_ids)
                         end
                       end
                       scope.sorted
                     else
                       []
                     end
                   end
                   def value_from_keyword(custom_field, keyword, object)
                     users = possible_values_records(custom_field, object).to_a
                     user = Principal.detect_by_keyword(users, keyword)
                     user ? user.id : nil
                   end
                   def before_custom_field_save(custom_field)
                     super
                     if custom_field.user_role.is_a?(Array)
                       custom_field.user_role.map!(&:to_s).reject!(&:blank?)
                     end
                   end
                 end
                 class VersionFormat < RecordList
                   add 'version'
                   self.form_partial = 'custom_fields/formats/version'
                   field_attributes :version_status
                   def possible_values_options(custom_field, object=nil)
                     versions_options(custom_field, object)
                   end
                   def before_custom_field_save(custom_field)
                     super
                     if custom_field.version_status.is_a?(Array)
                       custom_field.version_status.map!(&:to_s).reject!(&:blank?)
                     end
                   end
                   protected
                   def query_filter_values(custom_field, query)
                     versions_options(custom_field, query.project, true)
                   end
                   def versions_options(custom_field, object, all_statuses=false)
                     if object.is_a?(Array)
                       projects = object.map {|o| o.respond_to?(:project) ? o.project : nil}.compact.uniq
                       projects.map {|project| possible_values_options(custom_field, project)}.reduce(:&) || []
                     elsif object.respond_to?(:project) && object.project
                       scope = object.project.shared_versions
                       if !all_statuses && custom_field.version_status.is_a?(Array)
                         statuses = custom_field.version_status.map(&:to_s).reject(&:blank?)
                         if statuses.any?
                           scope = scope.where(:status => statuses.map(&:to_s))
                         end
                       end
                       scope.sort.collect {|u| [u.to_s, u.id.to_s]}
                     else
                       []
                     end
                   end
                 end
               end
             end

lib/redmine/wiki_formatting/markdown/formatter.rb +9 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'cgi'
             module Redmine
               module WikiFormatting
                 module Markdown
                   class HTML < Redcarpet::Render::HTML
                     include ActionView::Helpers::TagHelper
+                    include Redmine::Helpers::URL
                     def link(link, title, content)
+                      return nil unless uri_with_safe_scheme?(link)
                       css = nil
                       unless link && link.starts_with?('/')
                         css = 'external'
                       end
                       content_tag('a', content.to_s.html_safe, :href => link, :title => title, :class => css)
                     end
                     def block_code(code, language)
                       if language.present?
                         "<pre><code class=\"#{CGI.escapeHTML language} syntaxhl\">" +
                           Redmine::SyntaxHighlighting.highlight_by_language(code, language) +
                           "</code></pre>"
                       else
                         "<pre>" + CGI.escapeHTML(code) + "</pre>"
                       end
                     end
+                    def image(link, title, alt_text)
+                      return unless uri_with_safe_scheme?(link)
+                      tag('img', :src => link, :alt => alt_text || "", :title => title)
+                    end
                   end
                   class Formatter
                     def initialize(text)
                       @text = text
                     end
                     def to_html(*args)
                       html = formatter.render(@text)
                       # restore wiki links eg. [[Foo]]
                       html.gsub!(%r{\[<a href="(.*?)">(.*?)</a>\]}) do
                         "[[#{$2}]]"
                       end
                       # restore Redmine links with double-quotes, eg. version:"1.0"
                       html.gsub!(/(\w):&quot;(.+?)&quot;/) do
                         "#{$1}:\"#{$2}\""
                       end
                       html
                     end
                     def get_section(index)
                       section = extract_sections(index)[1]
                       hash = Digest::MD5.hexdigest(section)
                       return section, hash
                     end
                     def update_section(index, update, hash=nil)
                       t = extract_sections(index)
                       if hash.present? && hash != Digest::MD5.hexdigest(t[1])
                         raise Redmine::WikiFormatting::StaleSectionError
                       end
                       t[1] = update unless t[1].blank?
                       t.reject(&:blank?).join "\n\n"
                     end
                     def extract_sections(index)
                       sections = ['', '', '']
                       offset = 0
                       i = 0
                       l = 1
                       inside_pre = false
                       @text.split(/(^(?:.+\r?\n\r?(?:\=+|\-+)|#+.+|~~~.*)\s*$)/).each do |part|
                         level = nil
                         if part =~ /\A~{3,}(\S+)?\s*$/
                           if $1
                             if !inside_pre
                               inside_pre = true
                             end
                           else
                             inside_pre = !inside_pre
                           end
                         elsif inside_pre
                           # nop
                         elsif part =~ /\A(#+).+/
                           level = $1.size
                         elsif part =~ /\A.+\r?\n\r?(\=+|\-+)\s*$/
                           level = $1.include?('=') ? 1 : 2
                         end
                         if level
                           i += 1
                           if offset == 0 && i == index
                             # entering the requested section
                             offset = 1
                             l = level
                           elsif offset == 1 && i > index && level <= l
                             # leaving the requested section
                             offset = 2
                           end
                         end
                         sections[offset] << part
                       end
                       sections.map(&:strip)
                     end
                     private
                     def formatter
                       @@formatter ||= Redcarpet::Markdown.new(
                         Redmine::WikiFormatting::Markdown::HTML.new(
                           :filter_html => true,
                           :hard_wrap => true
                         ),
                         :autolink => true,
                         :fenced_code_blocks => true,
                         :space_after_headers => true,
                         :tables => true,
                         :strikethrough => true,
                         :superscript => true,
                         :no_intra_emphasis => true,
                         :footnotes => true
                       )
                     end
                   end
                 end
               end
             end

test/unit/helpers/application_helper_test.rb +1 -1

             # encoding: utf-8
             #
             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../test_helper', __FILE__)
             class ApplicationHelperTest < ActionView::TestCase
               include Redmine::I18n
               include ERB::Util
               include Rails.application.routes.url_helpers
               fixtures :projects, :roles, :enabled_modules, :users,
                        :email_addresses,
                        :repositories, :changesets,
                        :projects_trackers,
                        :trackers, :issue_statuses, :issues, :versions, :documents,
                        :wikis, :wiki_pages, :wiki_contents,
                        :boards, :messages, :news,
                        :attachments, :enumerations
               def setup
                 super
                 set_tmp_attachments_directory
                 @russian_test = "\xd1\x82\xd0\xb5\xd1\x81\xd1\x82".force_encoding('UTF-8')
               end
               test "#link_to_if_authorized for authorized user should allow using the :controller and :action for the target link" do
                 User.current = User.find_by_login('admin')
                 @project = Issue.first.project # Used by helper
                 response = link_to_if_authorized('By controller/actionr',
                                                 {:controller => 'issues', :action => 'edit', :id => Issue.first.id})
                 assert_match /href/, response
               end
               test "#link_to_if_authorized for unauthorized user should display nothing if user isn't authorized" do
                 User.current = User.find_by_login('dlopper')
                 @project = Project.find('private-child')
                 issue = @project.issues.first
                 assert !issue.visible?
                 response = link_to_if_authorized('Never displayed',
                                                 {:controller => 'issues', :action => 'show', :id => issue})
                 assert_nil response
               end
               def test_auto_links
                 to_test = {
                   'http://foo.bar' => '<a class="external" href="http://foo.bar">http://foo.bar</a>',
                   'http://foo.bar/~user' => '<a class="external" href="http://foo.bar/~user">http://foo.bar/~user</a>',
                   'http://foo.bar.' => '<a class="external" href="http://foo.bar">http://foo.bar</a>.',
                   'https://foo.bar.' => '<a class="external" href="https://foo.bar">https://foo.bar</a>.',
                   'This is a link: http://foo.bar.' => 'This is a link: <a class="external" href="http://foo.bar">http://foo.bar</a>.',
                   'A link (eg. http://foo.bar).' => 'A link (eg. <a class="external" href="http://foo.bar">http://foo.bar</a>).',
                   'http://foo.bar/foo.bar#foo.bar.' => '<a class="external" href="http://foo.bar/foo.bar#foo.bar">http://foo.bar/foo.bar#foo.bar</a>.',
                   'http://www.foo.bar/Test_(foobar)' => '<a class="external" href="http://www.foo.bar/Test_(foobar)">http://www.foo.bar/Test_(foobar)</a>',
                   '(see inline link : http://www.foo.bar/Test_(foobar))' => '(see inline link : <a class="external" href="http://www.foo.bar/Test_(foobar)">http://www.foo.bar/Test_(foobar)</a>)',
                   '(see inline link : http://www.foo.bar/Test)' => '(see inline link : <a class="external" href="http://www.foo.bar/Test">http://www.foo.bar/Test</a>)',
                   '(see inline link : http://www.foo.bar/Test).' => '(see inline link : <a class="external" href="http://www.foo.bar/Test">http://www.foo.bar/Test</a>).',
                   '(see "inline link":http://www.foo.bar/Test_(foobar))' => '(see <a href="http://www.foo.bar/Test_(foobar)" class="external">inline link</a>)',
                   '(see "inline link":http://www.foo.bar/Test)' => '(see <a href="http://www.foo.bar/Test" class="external">inline link</a>)',
                   '(see "inline link":http://www.foo.bar/Test).' => '(see <a href="http://www.foo.bar/Test" class="external">inline link</a>).',
                   'www.foo.bar' => '<a class="external" href="http://www.foo.bar">www.foo.bar</a>',
                   'http://foo.bar/page?p=1&t=z&s=' => '<a class="external" href="http://foo.bar/page?p=1&#38;t=z&#38;s=">http://foo.bar/page?p=1&#38;t=z&#38;s=</a>',
                   'http://foo.bar/page#125' => '<a class="external" href="http://foo.bar/page#125">http://foo.bar/page#125</a>',
                   'http://foo@www.bar.com' => '<a class="external" href="http://foo@www.bar.com">http://foo@www.bar.com</a>',
                   'http://foo:bar@www.bar.com' => '<a class="external" href="http://foo:bar@www.bar.com">http://foo:bar@www.bar.com</a>',
                   'ftp://foo.bar' => '<a class="external" href="ftp://foo.bar">ftp://foo.bar</a>',
                   'ftps://foo.bar' => '<a class="external" href="ftps://foo.bar">ftps://foo.bar</a>',
                   'sftp://foo.bar' => '<a class="external" href="sftp://foo.bar">sftp://foo.bar</a>',
                   # two exclamation marks
                   'http://example.net/path!602815048C7B5C20!302.html' => '<a class="external" href="http://example.net/path!602815048C7B5C20!302.html">http://example.net/path!602815048C7B5C20!302.html</a>',
                   # escaping
                   'http://foo"bar' => '<a class="external" href="http://foo&quot;bar">http://foo&quot;bar</a>',
                   # wrap in angle brackets
                   '<http://foo.bar>' => '&lt;<a class="external" href="http://foo.bar">http://foo.bar</a>&gt;',
                   # invalid urls
                   'http://' => 'http://',
                   'www.' => 'www.',
                   'test-www.bar.com' => 'test-www.bar.com',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_auto_links_with_non_ascii_characters
                 to_test = {
                   "http://foo.bar/#{@russian_test}" =>
                     %|<a class="external" href="http://foo.bar/#{@russian_test}">http://foo.bar/#{@russian_test}</a>|
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_auto_mailto
                 to_test = {
                   'test@foo.bar' => '<a class="email" href="mailto:test@foo.bar">test@foo.bar</a>',
                   'test@www.foo.bar' => '<a class="email" href="mailto:test@www.foo.bar">test@www.foo.bar</a>',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_inline_images
                 to_test = {
                   '!http://foo.bar/image.jpg!' => '<img src="http://foo.bar/image.jpg" alt="" />',
                   'floating !>http://foo.bar/image.jpg!' => 'floating <div style="float:right"><img src="http://foo.bar/image.jpg" alt="" /></div>',
                   'with class !(some-class)http://foo.bar/image.jpg!' => 'with class <img src="http://foo.bar/image.jpg" class="some-class" alt="" />',
                   'with style !{width:100px;height:100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" style="width:100px;height:100px;" alt="" />',
                   'with title !http://foo.bar/image.jpg(This is a title)!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a title" alt="This is a title" />',
                   'with title !http://foo.bar/image.jpg(This is a double-quoted "title")!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a double-quoted &quot;title&quot;" alt="This is a double-quoted &quot;title&quot;" />',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_inline_images_inside_tags
                 raw = <<-RAW
             h1. !foo.png! Heading
             Centered image:
             p=. !bar.gif!
             RAW
                 assert textilizable(raw).include?('<img src="foo.png" alt="" />')
                 assert textilizable(raw).include?('<img src="bar.gif" alt="" />')
               end
               def test_attached_images
                 to_test = {
                   'Inline image: !logo.gif!' => 'Inline image: <img src="/attachments/download/3/logo.gif" title="This is a logo" alt="This is a logo" />',
                   'Inline image: !logo.GIF!' => 'Inline image: <img src="/attachments/download/3/logo.gif" title="This is a logo" alt="This is a logo" />',
                   'No match: !ogo.gif!' => 'No match: <img src="ogo.gif" alt="" />',
                   'No match: !ogo.GIF!' => 'No match: <img src="ogo.GIF" alt="" />',
                   # link image
                   '!logo.gif!:http://foo.bar/' => '<a href="http://foo.bar/"><img src="/attachments/download/3/logo.gif" title="This is a logo" alt="This is a logo" /></a>',
                 }
                 attachments = Attachment.all
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text, :attachments => attachments) }
               end
               def test_attached_images_with_textile_and_non_ascii_filename
                 attachment = Attachment.generate!(:filename => 'café.jpg')
                 with_settings :text_formatting => 'textile' do
                   assert_include %(<img src="/attachments/download/#{attachment.id}/caf%C3%A9.jpg" alt="" />),
                     textilizable("!café.jpg!)", :attachments => [attachment])
                 end
               end
               def test_attached_images_with_markdown_and_non_ascii_filename
                 skip unless Object.const_defined?(:Redcarpet)
                 attachment = Attachment.generate!(:filename => 'café.jpg')
                 with_settings :text_formatting => 'markdown' do
-                  assert_include %(<img src="/attachments/download/#{attachment.id}/caf%C3%A9.jpg" alt="">),
+                  assert_include %(<img src="/attachments/download/#{attachment.id}/caf%C3%A9.jpg" alt="" />),
                     textilizable("![](café.jpg)", :attachments => [attachment])
                 end
               end
               def test_attached_images_filename_extension
                 set_tmp_attachments_directory
                 a1 = Attachment.new(
                         :container => Issue.find(1),
                         :file => mock_file_with_options({:original_filename => "testtest.JPG"}),
                         :author => User.find(1))
                 assert a1.save
                 assert_equal "testtest.JPG", a1.filename
                 assert_equal "image/jpeg", a1.content_type
                 assert a1.image?
                 a2 = Attachment.new(
                         :container => Issue.find(1),
                         :file => mock_file_with_options({:original_filename => "testtest.jpeg"}),
                         :author => User.find(1))
                 assert a2.save
                 assert_equal "testtest.jpeg", a2.filename
                 assert_equal "image/jpeg", a2.content_type
                 assert a2.image?
                 a3 = Attachment.new(
                         :container => Issue.find(1),
                         :file => mock_file_with_options({:original_filename => "testtest.JPE"}),
                         :author => User.find(1))
                 assert a3.save
                 assert_equal "testtest.JPE", a3.filename
                 assert_equal "image/jpeg", a3.content_type
                 assert a3.image?
                 a4 = Attachment.new(
                         :container => Issue.find(1),
                         :file => mock_file_with_options({:original_filename => "Testtest.BMP"}),
                         :author => User.find(1))
                 assert a4.save
                 assert_equal "Testtest.BMP", a4.filename
                 assert_equal "image/x-ms-bmp", a4.content_type
                 assert a4.image?
                 to_test = {
                   'Inline image: !testtest.jpg!' =>
                     'Inline image: <img src="/attachments/download/' + a1.id.to_s + '/testtest.JPG" alt="" />',
                   'Inline image: !testtest.jpeg!' =>
                     'Inline image: <img src="/attachments/download/' + a2.id.to_s + '/testtest.jpeg" alt="" />',
                   'Inline image: !testtest.jpe!' =>
                     'Inline image: <img src="/attachments/download/' + a3.id.to_s + '/testtest.JPE" alt="" />',
                   'Inline image: !testtest.bmp!' =>
                     'Inline image: <img src="/attachments/download/' + a4.id.to_s + '/Testtest.BMP" alt="" />',
                 }
                 attachments = [a1, a2, a3, a4]
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text, :attachments => attachments) }
               end
               def test_attached_images_should_read_later
                 set_fixtures_attachments_directory
                 a1 = Attachment.find(16)
                 assert_equal "testfile.png", a1.filename
                 assert a1.readable?
                 assert (! a1.visible?(User.anonymous))
                 assert a1.visible?(User.find(2))
                 a2 = Attachment.find(17)
                 assert_equal "testfile.PNG", a2.filename
                 assert a2.readable?
                 assert (! a2.visible?(User.anonymous))
                 assert a2.visible?(User.find(2))
                 assert a1.created_on < a2.created_on
                 to_test = {
                   'Inline image: !testfile.png!' =>
                     'Inline image: <img src="/attachments/download/' + a2.id.to_s + '/testfile.PNG" alt="" />',
                   'Inline image: !Testfile.PNG!' =>
                     'Inline image: <img src="/attachments/download/' + a2.id.to_s + '/testfile.PNG" alt="" />',
                 }
                 attachments = [a1, a2]
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text, :attachments => attachments) }
                 set_tmp_attachments_directory
               end
               def test_textile_external_links
                 to_test = {
                   'This is a "link":http://foo.bar' => 'This is a <a href="http://foo.bar" class="external">link</a>',
                   'This is an intern "link":/foo/bar' => 'This is an intern <a href="/foo/bar">link</a>',
                   '"link (Link title)":http://foo.bar' => '<a href="http://foo.bar" title="Link title" class="external">link</a>',
                   '"link (Link title with "double-quotes")":http://foo.bar' => '<a href="http://foo.bar" title="Link title with &quot;double-quotes&quot;" class="external">link</a>',
                   "This is not a \"Link\":\n\nAnother paragraph" => "This is not a \"Link\":</p>\n\n\n\t<p>Another paragraph",
                   # no multiline link text
                   "This is a double quote \"on the first line\nand another on a second line\":test" => "This is a double quote \"on the first line<br />and another on a second line\":test",
                   # mailto link
                   "\"system administrator\":mailto:sysadmin@example.com?subject=redmine%20permissions" => "<a href=\"mailto:sysadmin@example.com?subject=redmine%20permissions\">system administrator</a>",
                   # two exclamation marks
                   '"a link":http://example.net/path!602815048C7B5C20!302.html' => '<a href="http://example.net/path!602815048C7B5C20!302.html" class="external">a link</a>',
                   # escaping
                   '"test":http://foo"bar' => '<a href="http://foo&quot;bar" class="external">test</a>',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_textile_external_links_with_non_ascii_characters
                 to_test = {
                   %|This is a "link":http://foo.bar/#{@russian_test}| =>
                     %|This is a <a href="http://foo.bar/#{@russian_test}" class="external">link</a>|
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_redmine_links
                 issue_link = link_to('#3', {:controller => 'issues', :action => 'show', :id => 3},
                                            :class => Issue.find(3).css_classes, :title => 'Bug: Error 281 when updating a recipe (New)')
                 note_link = link_to('#3-14', {:controller => 'issues', :action => 'show', :id => 3, :anchor => 'note-14'},
                                            :class => Issue.find(3).css_classes, :title => 'Bug: Error 281 when updating a recipe (New)')
                 note_link2 = link_to('#3#note-14', {:controller => 'issues', :action => 'show', :id => 3, :anchor => 'note-14'},
                                            :class => Issue.find(3).css_classes, :title => 'Bug: Error 281 when updating a recipe (New)')
                 revision_link = link_to('r1', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 1},
                                                :class => 'changeset', :title => 'My very first commit do not escaping #<>&')
                 revision_link2 = link_to('r2', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 2},
                                                 :class => 'changeset', :title => 'This commit fixes #1, #2 and references #1 & #3')
                 changeset_link2 = link_to('691322a8eb01e11fd7',
                                           {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 1},
                                            :class => 'changeset', :title => 'My very first commit do not escaping #<>&')
                 document_link = link_to('Test document', {:controller => 'documents', :action => 'show', :id => 1},
                                                          :class => 'document')
                 version_link = link_to('1.0', {:controller => 'versions', :action => 'show', :id => 2},
                                               :class => 'version')
                 board_url = {:controller => 'boards', :action => 'show', :id => 2, :project_id => 'ecookbook'}
                 message_url = {:controller => 'messages', :action => 'show', :board_id => 1, :id => 4}
                 news_url = {:controller => 'news', :action => 'show', :id => 1}
                 project_url = {:controller => 'projects', :action => 'show', :id => 'subproject1'}
                 source_url = '/projects/ecookbook/repository/entry/some/file'
                 source_url_with_rev = '/projects/ecookbook/repository/revisions/52/entry/some/file'
                 source_url_with_ext = '/projects/ecookbook/repository/entry/some/file.ext'
                 source_url_with_rev_and_ext = '/projects/ecookbook/repository/revisions/52/entry/some/file.ext'
                 source_url_with_branch = '/projects/ecookbook/repository/revisions/branch/entry/some/file'
                 export_url = '/projects/ecookbook/repository/raw/some/file'
                 export_url_with_rev = '/projects/ecookbook/repository/revisions/52/raw/some/file'
                 export_url_with_ext = '/projects/ecookbook/repository/raw/some/file.ext'
                 export_url_with_rev_and_ext = '/projects/ecookbook/repository/revisions/52/raw/some/file.ext'
                 export_url_with_branch = '/projects/ecookbook/repository/revisions/branch/raw/some/file'
                 to_test = {
                   # tickets
                   '#3, [#3], (#3) and #3.'      => "#{issue_link}, [#{issue_link}], (#{issue_link}) and #{issue_link}.",
                   # ticket notes
                   '#3-14'                       => note_link,
                   '#3#note-14'                  => note_link2,
                   # should not ignore leading zero
                   '#03'                         => '#03',
                   # changesets
                   'r1'                          => revision_link,
                   'r1.'                         => "#{revision_link}.",
                   'r1, r2'                      => "#{revision_link}, #{revision_link2}",
                   'r1,r2'                       => "#{revision_link},#{revision_link2}",
                   'commit:691322a8eb01e11fd7'   => changeset_link2,
                   # documents
                   'document#1'                  => document_link,
                   'document:"Test document"'    => document_link,
                   # versions
                   'version#2'                   => version_link,
                   'version:1.0'                 => version_link,
                   'version:"1.0"'               => version_link,
                   # source
                   'source:some/file'            => link_to('source:some/file', source_url, :class => 'source'),
                   'source:/some/file'           => link_to('source:/some/file', source_url, :class => 'source'),
                   'source:/some/file.'          => link_to('source:/some/file', source_url, :class => 'source') + ".",
                   'source:/some/file.ext.'      => link_to('source:/some/file.ext', source_url_with_ext, :class => 'source') + ".",
                   'source:/some/file. '         => link_to('source:/some/file', source_url, :class => 'source') + ".",
                   'source:/some/file.ext. '     => link_to('source:/some/file.ext', source_url_with_ext, :class => 'source') + ".",
                   'source:/some/file, '         => link_to('source:/some/file', source_url, :class => 'source') + ",",
                   'source:/some/file@52'        => link_to('source:/some/file@52', source_url_with_rev, :class => 'source'),
                   'source:/some/file@branch'    => link_to('source:/some/file@branch', source_url_with_branch, :class => 'source'),
                   'source:/some/file.ext@52'    => link_to('source:/some/file.ext@52', source_url_with_rev_and_ext, :class => 'source'),
                   'source:/some/file#L110'      => link_to('source:/some/file#L110', source_url + "#L110", :class => 'source'),
                   'source:/some/file.ext#L110'  => link_to('source:/some/file.ext#L110', source_url_with_ext + "#L110", :class => 'source'),
                   'source:/some/file@52#L110'   => link_to('source:/some/file@52#L110', source_url_with_rev + "#L110", :class => 'source'),
                   # export
                   'export:/some/file'           => link_to('export:/some/file', export_url, :class => 'source download'),
                   'export:/some/file.ext'       => link_to('export:/some/file.ext', export_url_with_ext, :class => 'source download'),
                   'export:/some/file@52'        => link_to('export:/some/file@52', export_url_with_rev, :class => 'source download'),
                   'export:/some/file.ext@52'    => link_to('export:/some/file.ext@52', export_url_with_rev_and_ext, :class => 'source download'),
                   'export:/some/file@branch'    => link_to('export:/some/file@branch', export_url_with_branch, :class => 'source download'),
                   # forum
                   'forum#2'                     => link_to('Discussion', board_url, :class => 'board'),
                   'forum:Discussion'            => link_to('Discussion', board_url, :class => 'board'),
                   # message
                   'message#4'                   => link_to('Post 2', message_url, :class => 'message'),
                   'message#5'                   => link_to('RE: post 2', message_url.merge(:anchor => 'message-5', :r => 5), :class => 'message'),
                   # news
                   'news#1'                      => link_to('eCookbook first release !', news_url, :class => 'news'),
                   'news:"eCookbook first release !"'        => link_to('eCookbook first release !', news_url, :class => 'news'),
                   # project
                   'project#3'                   => link_to('eCookbook Subproject 1', project_url, :class => 'project'),
                   'project:subproject1'         => link_to('eCookbook Subproject 1', project_url, :class => 'project'),
                   'project:"eCookbook subProject 1"'        => link_to('eCookbook Subproject 1', project_url, :class => 'project'),
                   # not found
                   '#0123456789'                 => '#0123456789',
                   # invalid expressions
                   'source:'                     => 'source:',
                   # url hash
                   "http://foo.bar/FAQ#3"       => '<a class="external" href="http://foo.bar/FAQ#3">http://foo.bar/FAQ#3</a>',
                 }
                 @project = Project.find(1)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text), "#{text} failed" }
               end
               def test_should_not_parse_redmine_links_inside_link
                 raw = "r1 should not be parsed in http://example.com/url-r1/"
                 assert_match %r{<p><a class="changeset".*>r1</a> should not be parsed in <a class="external" href="http://example.com/url-r1/">http://example.com/url-r1/</a></p>},
                   textilizable(raw, :project => Project.find(1))
               end
               def test_redmine_links_with_a_different_project_before_current_project
                 vp1 = Version.generate!(:project_id => 1, :name => '1.4.4')
                 vp3 = Version.generate!(:project_id => 3, :name => '1.4.4')
                 @project = Project.find(3)
                 result1 = link_to("1.4.4", "/versions/#{vp1.id}", :class => "version")
                 result2 = link_to("1.4.4", "/versions/#{vp3.id}", :class => "version")
                 assert_equal "<p>#{result1} #{result2}</p>",
                              textilizable("ecookbook:version:1.4.4 version:1.4.4")
               end
               def test_escaped_redmine_links_should_not_be_parsed
                 to_test = [
                   '#3.',
                   '#3-14.',
                   '#3#-note14.',
                   'r1',
                   'document#1',
                   'document:"Test document"',
                   'version#2',
                   'version:1.0',
                   'version:"1.0"',
                   'source:/some/file'
                 ]
                 @project = Project.find(1)
                 to_test.each { |text| assert_equal "<p>#{text}</p>", textilizable("!" + text), "#{text} failed" }
               end
               def test_cross_project_redmine_links
                 source_link = link_to('ecookbook:source:/some/file',
                                       {:controller => 'repositories', :action => 'entry',
                                        :id => 'ecookbook', :path => ['some', 'file']},
                                       :class => 'source')
                 changeset_link = link_to('ecookbook:r2',
                                          {:controller => 'repositories', :action => 'revision',
                                           :id => 'ecookbook', :rev => 2},
                                          :class => 'changeset',
                                          :title => 'This commit fixes #1, #2 and references #1 & #3')
                 to_test = {
                   # documents
                   'document:"Test document"'              => 'document:"Test document"',
                   'ecookbook:document:"Test document"'    =>
                       link_to("Test document", "/documents/1", :class => "document"),
                   'invalid:document:"Test document"'      => 'invalid:document:"Test document"',
                   # versions
                   'version:"1.0"'                         => 'version:"1.0"',
                   'ecookbook:version:"1.0"'               =>
                       link_to("1.0", "/versions/2", :class => "version"),
                   'invalid:version:"1.0"'                 => 'invalid:version:"1.0"',
                   # changeset
                   'r2'                                    => 'r2',
                   'ecookbook:r2'                          => changeset_link,
                   'invalid:r2'                            => 'invalid:r2',
                   # source
                   'source:/some/file'                     => 'source:/some/file',
                   'ecookbook:source:/some/file'           => source_link,
                   'invalid:source:/some/file'             => 'invalid:source:/some/file',
                 }
                 @project = Project.find(3)
                 to_test.each do |text, result|
                   assert_equal "<p>#{result}</p>", textilizable(text), "#{text} failed"
                 end
               end
               def test_redmine_links_by_name_should_work_with_html_escaped_characters
                 v = Version.generate!(:name => "Test & Show.txt", :project_id => 1)
                 link = link_to("Test & Show.txt", "/versions/#{v.id}", :class => "version")
                 @project = v.project
                 assert_equal "<p>#{link}</p>", textilizable('version:"Test & Show.txt"')
               end
               def test_link_to_issue_subject
                 issue = Issue.generate!(:subject => "01234567890123456789")
                 str = link_to_issue(issue, :truncate => 10)
                 result = link_to("Bug ##{issue.id}", "/issues/#{issue.id}", :class => issue.css_classes)
                 assert_equal "#{result}: 0123456...", str
                 issue = Issue.generate!(:subject => "<&>")
                 str = link_to_issue(issue)
                 result = link_to("Bug ##{issue.id}", "/issues/#{issue.id}", :class => issue.css_classes)
                 assert_equal "#{result}: &lt;&amp;&gt;", str
                 issue = Issue.generate!(:subject => "<&>0123456789012345")
                 str = link_to_issue(issue, :truncate => 10)
                 result = link_to("Bug ##{issue.id}", "/issues/#{issue.id}", :class => issue.css_classes)
                 assert_equal "#{result}: &lt;&amp;&gt;0123...", str
               end
               def test_link_to_issue_title
                 long_str = "0123456789" * 5
                 issue = Issue.generate!(:subject => "#{long_str}01234567890123456789")
                 str = link_to_issue(issue, :subject => false)
                 result = link_to("Bug ##{issue.id}", "/issues/#{issue.id}",
                                  :class => issue.css_classes,
                                  :title => "#{long_str}0123456...")
                 assert_equal result, str
                 issue = Issue.generate!(:subject => "<&>#{long_str}01234567890123456789")
                 str = link_to_issue(issue, :subject => false)
                 result = link_to("Bug ##{issue.id}", "/issues/#{issue.id}",
                                  :class => issue.css_classes,
                                  :title => "<&>#{long_str}0123...")
                 assert_equal result, str
               end
               def test_multiple_repositories_redmine_links
                 svn = Repository::Subversion.create!(:project_id => 1, :identifier => 'svn_repo-1', :url => 'file:///foo/hg')
                 Changeset.create!(:repository => svn, :committed_on => Time.now, :revision => '123')
                 hg = Repository::Mercurial.create!(:project_id => 1, :identifier => 'hg1', :url => '/foo/hg')
                 Changeset.create!(:repository => hg, :committed_on => Time.now, :revision => '123', :scmid => 'abcd')
                 changeset_link = link_to('r2', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 2},
                                                 :class => 'changeset', :title => 'This commit fixes #1, #2 and references #1 & #3')
                 svn_changeset_link = link_to('svn_repo-1|r123', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :repository_id => 'svn_repo-1', :rev => 123},
                                                 :class => 'changeset', :title => '')
                 hg_changeset_link = link_to('hg1|abcd', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :repository_id => 'hg1', :rev => 'abcd'},
                                                 :class => 'changeset', :title => '')
                 source_link = link_to('source:some/file', {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :path => ['some', 'file']}, :class => 'source')
                 hg_source_link = link_to('source:hg1|some/file', {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :repository_id => 'hg1', :path => ['some', 'file']}, :class => 'source')
                 to_test = {
                   'r2'                          => changeset_link,
                   'svn_repo-1|r123'             => svn_changeset_link,
                   'invalid|r123'                => 'invalid|r123',
                   'commit:hg1|abcd'             => hg_changeset_link,
                   'commit:invalid|abcd'         => 'commit:invalid|abcd',
                   # source
                   'source:some/file'            => source_link,
                   'source:hg1|some/file'        => hg_source_link,
                   'source:invalid|some/file'    => 'source:invalid|some/file',
                 }
                 @project = Project.find(1)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text), "#{text} failed" }
               end
               def test_cross_project_multiple_repositories_redmine_links
                 svn = Repository::Subversion.create!(:project_id => 1, :identifier => 'svn1', :url => 'file:///foo/hg')
                 Changeset.create!(:repository => svn, :committed_on => Time.now, :revision => '123')
                 hg = Repository::Mercurial.create!(:project_id => 1, :identifier => 'hg1', :url => '/foo/hg')
                 Changeset.create!(:repository => hg, :committed_on => Time.now, :revision => '123', :scmid => 'abcd')
                 changeset_link = link_to('ecookbook:r2', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 2},
                                                 :class => 'changeset', :title => 'This commit fixes #1, #2 and references #1 & #3')
                 svn_changeset_link = link_to('ecookbook:svn1|r123', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :repository_id => 'svn1', :rev => 123},
                                                 :class => 'changeset', :title => '')
                 hg_changeset_link = link_to('ecookbook:hg1|abcd', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :repository_id => 'hg1', :rev => 'abcd'},
                                                 :class => 'changeset', :title => '')
                 source_link = link_to('ecookbook:source:some/file', {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :path => ['some', 'file']}, :class => 'source')
                 hg_source_link = link_to('ecookbook:source:hg1|some/file', {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :repository_id => 'hg1', :path => ['some', 'file']}, :class => 'source')
                 to_test = {
                   'ecookbook:r2'                           => changeset_link,
                   'ecookbook:svn1|r123'                    => svn_changeset_link,
                   'ecookbook:invalid|r123'                 => 'ecookbook:invalid|r123',
                   'ecookbook:commit:hg1|abcd'              => hg_changeset_link,
                   'ecookbook:commit:invalid|abcd'          => 'ecookbook:commit:invalid|abcd',
                   'invalid:commit:invalid|abcd'            => 'invalid:commit:invalid|abcd',
                   # source
                   'ecookbook:source:some/file'             => source_link,
                   'ecookbook:source:hg1|some/file'         => hg_source_link,
                   'ecookbook:source:invalid|some/file'     => 'ecookbook:source:invalid|some/file',
                   'invalid:source:invalid|some/file'       => 'invalid:source:invalid|some/file',
                 }
                 @project = Project.find(3)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text), "#{text} failed" }
               end
               def test_redmine_links_git_commit
                 changeset_link = link_to('abcd',
                                            {
                                              :controller => 'repositories',
                                              :action     => 'revision',
                                              :id         => 'subproject1',
                                              :rev        => 'abcd',
                                             },
                                           :class => 'changeset', :title => 'test commit')
                 to_test = {
                   'commit:abcd' => changeset_link,
                  }
                 @project = Project.find(3)
                 r = Repository::Git.create!(:project => @project, :url => '/tmp/test/git')
                 assert r
                 c = Changeset.new(:repository => r,
                                   :committed_on => Time.now,
                                   :revision => 'abcd',
                                   :scmid => 'abcd',
                                   :comments => 'test commit')
                 assert( c.save )
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               # TODO: Bazaar commit id contains mail address, so it contains '@' and '_'.
               def test_redmine_links_darcs_commit
                 changeset_link = link_to('20080308225258-98289-abcd456efg.gz',
                                            {
                                              :controller => 'repositories',
                                              :action     => 'revision',
                                              :id         => 'subproject1',
                                              :rev        => '123',
                                             },
                                           :class => 'changeset', :title => 'test commit')
                 to_test = {
                   'commit:20080308225258-98289-abcd456efg.gz' => changeset_link,
                  }
                 @project = Project.find(3)
                 r = Repository::Darcs.create!(
                         :project => @project, :url => '/tmp/test/darcs',
                         :log_encoding => 'UTF-8')
                 assert r
                 c = Changeset.new(:repository => r,
                                   :committed_on => Time.now,
                                   :revision => '123',
                                   :scmid => '20080308225258-98289-abcd456efg.gz',
                                   :comments => 'test commit')
                 assert( c.save )
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_redmine_links_mercurial_commit
                 changeset_link_rev = link_to('r123',
                                               {
                                                  :controller => 'repositories',
                                                  :action     => 'revision',
                                                  :id         => 'subproject1',
                                                  :rev        => '123' ,
                                               },
                                           :class => 'changeset', :title => 'test commit')
                 changeset_link_commit = link_to('abcd',
                                               {
                                                     :controller => 'repositories',
                                                     :action     => 'revision',
                                                     :id         => 'subproject1',
                                                     :rev        => 'abcd' ,
                                               },
                                           :class => 'changeset', :title => 'test commit')
                 to_test = {
                   'r123' => changeset_link_rev,
                   'commit:abcd' => changeset_link_commit,
                  }
                 @project = Project.find(3)
                 r = Repository::Mercurial.create!(:project => @project, :url => '/tmp/test')
                 assert r
                 c = Changeset.new(:repository => r,
                                   :committed_on => Time.now,
                                   :revision => '123',
                                   :scmid => 'abcd',
                                   :comments => 'test commit')
                 assert( c.save )
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_attachment_links
                 text = 'attachment:error281.txt'
                 result = link_to("error281.txt", "/attachments/download/1/error281.txt",
                                  :class => "attachment")
                 assert_equal "<p>#{result}</p>",
                              textilizable(text,
                                           :attachments => Issue.find(3).attachments),
                              "#{text} failed"
               end
               def test_attachment_link_should_link_to_latest_attachment
                 set_tmp_attachments_directory
                 a1 = Attachment.generate!(:filename => "test.txt", :created_on => 1.hour.ago)
                 a2 = Attachment.generate!(:filename => "test.txt")
                 result = link_to("test.txt", "/attachments/download/#{a2.id}/test.txt",
                                  :class => "attachment")
                 assert_equal "<p>#{result}</p>",
                              textilizable('attachment:test.txt', :attachments => [a1, a2])
               end
               def test_wiki_links
                 russian_eacape = CGI.escape(@russian_test)
                 to_test = {
                   '[[CookBook documentation]]' =>
                       link_to("CookBook documentation",
                               "/projects/ecookbook/wiki/CookBook_documentation",
                               :class => "wiki-page"),
                   '[[Another page|Page]]' =>
                       link_to("Page",
                               "/projects/ecookbook/wiki/Another_page",
                               :class => "wiki-page"),
                   # title content should be formatted
                   '[[Another page|With _styled_ *title*]]' =>
                       link_to("With <em>styled</em> <strong>title</strong>".html_safe,
                               "/projects/ecookbook/wiki/Another_page",
                               :class => "wiki-page"),
                   '[[Another page|With title containing <strong>HTML entities &amp; markups</strong>]]' =>
                       link_to("With title containing &lt;strong&gt;HTML entities &amp; markups&lt;/strong&gt;".html_safe,
                               "/projects/ecookbook/wiki/Another_page",
                               :class => "wiki-page"),
                   # link with anchor
                   '[[CookBook documentation#One-section]]' =>
                       link_to("CookBook documentation",
                               "/projects/ecookbook/wiki/CookBook_documentation#One-section",
                               :class => "wiki-page"),
                   '[[Another page#anchor|Page]]' =>
                       link_to("Page",
                               "/projects/ecookbook/wiki/Another_page#anchor",
                               :class => "wiki-page"),
                   # UTF8 anchor
                   "[[Another_page##{@russian_test}|#{@russian_test}]]" =>
                       link_to(@russian_test,
                               "/projects/ecookbook/wiki/Another_page##{russian_eacape}",
                               :class => "wiki-page"),
                   # page that doesn't exist
                   '[[Unknown page]]' =>
                       link_to("Unknown page",
                               "/projects/ecookbook/wiki/Unknown_page",
                               :class => "wiki-page new"),
                   '[[Unknown page|404]]' =>
                       link_to("404",
                               "/projects/ecookbook/wiki/Unknown_page",
                               :class => "wiki-page new"),
                   # link to another project wiki
                   '[[onlinestore:]]' =>
                       link_to("onlinestore",
                               "/projects/onlinestore/wiki",
                               :class => "wiki-page"),
                   '[[onlinestore:|Wiki]]' =>
                       link_to("Wiki",
                               "/projects/onlinestore/wiki",
                               :class => "wiki-page"),
                   '[[onlinestore:Start page]]' =>
                       link_to("Start page",
                               "/projects/onlinestore/wiki/Start_page",
                               :class => "wiki-page"),
                   '[[onlinestore:Start page|Text]]' =>
                       link_to("Text",
                               "/projects/onlinestore/wiki/Start_page",
                               :class => "wiki-page"),
                   '[[onlinestore:Unknown page]]' =>
                       link_to("Unknown page",
                               "/projects/onlinestore/wiki/Unknown_page",
                               :class => "wiki-page new"),
                   # struck through link
                   '-[[Another page|Page]]-' =>
                       "<del>".html_safe +
                         link_to("Page",
                                 "/projects/ecookbook/wiki/Another_page",
                                 :class => "wiki-page").html_safe +
                         "</del>".html_safe,
                   '-[[Another page|Page]] link-' =>
                       "<del>".html_safe +
                         link_to("Page",
                                 "/projects/ecookbook/wiki/Another_page",
                                 :class => "wiki-page").html_safe +
                         " link</del>".html_safe,
                   # escaping
                   '![[Another page|Page]]' => '[[Another page|Page]]',
                   # project does not exist
                   '[[unknowproject:Start]]' => '[[unknowproject:Start]]',
                   '[[unknowproject:Start|Page title]]' => '[[unknowproject:Start|Page title]]',
                 }
                 @project = Project.find(1)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_wiki_links_within_local_file_generation_context
                 to_test = {
                   # link to a page
                   '[[CookBook documentation]]' =>
                      link_to("CookBook documentation", "CookBook_documentation.html",
                              :class => "wiki-page"),
                   '[[CookBook documentation|documentation]]' =>
                      link_to("documentation", "CookBook_documentation.html",
                              :class => "wiki-page"),
                   '[[CookBook documentation#One-section]]' =>
                      link_to("CookBook documentation", "CookBook_documentation.html#One-section",
                              :class => "wiki-page"),
                   '[[CookBook documentation#One-section|documentation]]' =>
                      link_to("documentation", "CookBook_documentation.html#One-section",
                              :class => "wiki-page"),
                   # page that doesn't exist
                   '[[Unknown page]]' =>
                      link_to("Unknown page", "Unknown_page.html",
                              :class => "wiki-page new"),
                   '[[Unknown page|404]]' =>
                      link_to("404", "Unknown_page.html",
                              :class => "wiki-page new"),
                   '[[Unknown page#anchor]]' =>
                      link_to("Unknown page", "Unknown_page.html#anchor",
                              :class => "wiki-page new"),
                   '[[Unknown page#anchor|404]]' =>
                      link_to("404", "Unknown_page.html#anchor",
                              :class => "wiki-page new"),
                 }
                 @project = Project.find(1)
                 to_test.each do |text, result|
                   assert_equal "<p>#{result}</p>", textilizable(text, :wiki_links => :local)
                 end
               end
               def test_wiki_links_within_wiki_page_context
                 page = WikiPage.find_by_title('Another_page' )
                 to_test = {
                   '[[CookBook documentation]]' =>
                      link_to("CookBook documentation",
                              "/projects/ecookbook/wiki/CookBook_documentation",
                              :class => "wiki-page"),
                   '[[CookBook documentation|documentation]]' =>
                      link_to("documentation",
                              "/projects/ecookbook/wiki/CookBook_documentation",
                              :class => "wiki-page"),
                   '[[CookBook documentation#One-section]]' =>
                      link_to("CookBook documentation",
                              "/projects/ecookbook/wiki/CookBook_documentation#One-section",
                              :class => "wiki-page"),
                   '[[CookBook documentation#One-section|documentation]]' =>
                      link_to("documentation",
                              "/projects/ecookbook/wiki/CookBook_documentation#One-section",
                              :class => "wiki-page"),
                   # link to the current page
                   '[[Another page]]' =>
                      link_to("Another page",
                              "/projects/ecookbook/wiki/Another_page",
                              :class => "wiki-page"),
                   '[[Another page|Page]]' =>
                      link_to("Page",
                              "/projects/ecookbook/wiki/Another_page",
                              :class => "wiki-page"),
                   '[[Another page#anchor]]' =>
                      link_to("Another page",
                              "#anchor",
                              :class => "wiki-page"),
                   '[[Another page#anchor|Page]]' =>
                      link_to("Page",
                              "#anchor",
                              :class => "wiki-page"),
                   # page that doesn't exist
                   '[[Unknown page]]' =>
                      link_to("Unknown page",
                              "/projects/ecookbook/wiki/Unknown_page?parent=Another_page",
                              :class => "wiki-page new"),
                   '[[Unknown page|404]]' =>
                      link_to("404",
                              "/projects/ecookbook/wiki/Unknown_page?parent=Another_page",
                              :class => "wiki-page new"),
                   '[[Unknown page#anchor]]' =>
                      link_to("Unknown page",
                              "/projects/ecookbook/wiki/Unknown_page?parent=Another_page#anchor",
                              :class => "wiki-page new"),
                   '[[Unknown page#anchor|404]]' =>
                      link_to("404",
                              "/projects/ecookbook/wiki/Unknown_page?parent=Another_page#anchor",
                              :class => "wiki-page new"),
                 }
                 @project = Project.find(1)
                 to_test.each do |text, result|
                   assert_equal "<p>#{result}</p>",
                                textilizable(WikiContent.new( :text => text, :page => page ), :text)
                 end
               end
               def test_wiki_links_anchor_option_should_prepend_page_title_to_href
                 to_test = {
                   # link to a page
                   '[[CookBook documentation]]' =>
                       link_to("CookBook documentation",
                               "#CookBook_documentation",
                               :class => "wiki-page"),
                   '[[CookBook documentation|documentation]]' =>
                       link_to("documentation",
                               "#CookBook_documentation",
                               :class => "wiki-page"),
                   '[[CookBook documentation#One-section]]' =>
                       link_to("CookBook documentation",
                               "#CookBook_documentation_One-section",
                               :class => "wiki-page"),
                   '[[CookBook documentation#One-section|documentation]]' =>
                       link_to("documentation",
                               "#CookBook_documentation_One-section",
                               :class => "wiki-page"),
                   # page that doesn't exist
                   '[[Unknown page]]' =>
                       link_to("Unknown page",
                               "#Unknown_page",
                               :class => "wiki-page new"),
                   '[[Unknown page|404]]' =>
                       link_to("404",
                               "#Unknown_page",
                               :class => "wiki-page new"),
                   '[[Unknown page#anchor]]' =>
                       link_to("Unknown page",
                               "#Unknown_page_anchor",
                               :class => "wiki-page new"),
                   '[[Unknown page#anchor|404]]' =>
                       link_to("404",
                               "#Unknown_page_anchor",
                               :class => "wiki-page new"),
                 }
                 @project = Project.find(1)
                 to_test.each do |text, result|
                   assert_equal "<p>#{result}</p>", textilizable(text, :wiki_links => :anchor)
                 end
               end
               def test_html_tags
                 to_test = {
                   "<div>content</div>" => "<p>&lt;div&gt;content&lt;/div&gt;</p>",
                   "<div class=\"bold\">content</div>" => "<p>&lt;div class=\"bold\"&gt;content&lt;/div&gt;</p>",
                   "<script>some script;</script>" => "<p>&lt;script&gt;some script;&lt;/script&gt;</p>",
                   # do not escape pre/code tags
                   "<pre>\nline 1\nline2</pre>" => "<pre>\nline 1\nline2</pre>",
                   "<pre><code>\nline 1\nline2</code></pre>" => "<pre><code>\nline 1\nline2</code></pre>",
                   "<pre><div>content</div></pre>" => "<pre>&lt;div&gt;content&lt;/div&gt;</pre>",
                   "HTML comment: <!-- no comments -->" => "<p>HTML comment: &lt;!-- no comments --&gt;</p>",
                   "<!-- opening comment" => "<p>&lt;!-- opening comment</p>",
                   # remove attributes except class
                   "<pre class='foo'>some text</pre>" => "<pre class='foo'>some text</pre>",
                   '<pre class="foo">some text</pre>' => '<pre class="foo">some text</pre>',
                   "<pre class='foo bar'>some text</pre>" => "<pre class='foo bar'>some text</pre>",
                   '<pre class="foo bar">some text</pre>' => '<pre class="foo bar">some text</pre>',
                   "<pre onmouseover='alert(1)'>some text</pre>" => "<pre>some text</pre>",
                   # xss
                   '<pre><code class=""onmouseover="alert(1)">text</code></pre>' => '<pre><code>text</code></pre>',
                   '<pre class=""onmouseover="alert(1)">text</pre>' => '<pre>text</pre>',
                 }
                 to_test.each { |text, result| assert_equal result, textilizable(text) }
               end
               def test_allowed_html_tags
                 to_test = {
                   "<pre>preformatted text</pre>" => "<pre>preformatted text</pre>",
                   "<notextile>no *textile* formatting</notextile>" => "no *textile* formatting",
                   "<notextile>this is <tag>a tag</tag></notextile>" => "this is &lt;tag&gt;a tag&lt;/tag&gt;"
                 }
                 to_test.each { |text, result| assert_equal result, textilizable(text) }
               end
               def test_pre_tags
                 raw = <<-RAW
             Before
             <pre>
             <prepared-statement-cache-size>32</prepared-statement-cache-size>
             </pre>
             After
             RAW
                 expected = <<-EXPECTED
             <p>Before</p>
             <pre>
             &lt;prepared-statement-cache-size&gt;32&lt;/prepared-statement-cache-size&gt;
             </pre>
             <p>After</p>
             EXPECTED
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_pre_content_should_not_parse_wiki_and_redmine_links
                 raw = <<-RAW
             [[CookBook documentation]]
             #1
             <pre>
             [[CookBook documentation]]
             #1
             </pre>
             RAW
                 result1 = link_to("CookBook documentation",
                                   "/projects/ecookbook/wiki/CookBook_documentation",
                                   :class => "wiki-page")
                 result2 = link_to('#1',
                                   "/issues/1",
                                   :class => Issue.find(1).css_classes,
                                   :title => "Bug: Cannot print recipes (New)")
                 expected = <<-EXPECTED
             <p>#{result1}</p>
             <p>#{result2}</p>
             <pre>
             [[CookBook documentation]]
             #1
             </pre>
             EXPECTED
                 @project = Project.find(1)
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_non_closing_pre_blocks_should_be_closed
                 raw = <<-RAW
             <pre><code>
             RAW
                 expected = <<-EXPECTED
             <pre><code>
             </code></pre>
             EXPECTED
                 @project = Project.find(1)
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_unbalanced_closing_pre_tag_should_not_error
                 assert_nothing_raised do
                   textilizable("unbalanced</pre>")
                 end
               end
               def test_syntax_highlight
                 raw = <<-RAW
             <pre><code class="ruby">
             # Some ruby code here
             </code></pre>
             RAW
                 expected = <<-EXPECTED
             <pre><code class="ruby syntaxhl"><span class=\"CodeRay\"><span class="comment"># Some ruby code here</span></span>
             </code></pre>
             EXPECTED
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_to_path_param
                 assert_equal 'test1/test2', to_path_param('test1/test2')
                 assert_equal 'test1/test2', to_path_param('/test1/test2/')
                 assert_equal 'test1/test2', to_path_param('//test1/test2/')
                 assert_equal nil, to_path_param('/')
               end
               def test_wiki_links_in_tables
                 text = "|[[Page|Link title]]|[[Other Page|Other title]]|\n|Cell 21|[[Last page]]|"
                 link1 = link_to("Link title", "/projects/ecookbook/wiki/Page", :class => "wiki-page new")
                 link2 = link_to("Other title", "/projects/ecookbook/wiki/Other_Page", :class => "wiki-page new")
                 link3 = link_to("Last page", "/projects/ecookbook/wiki/Last_page", :class => "wiki-page new")
                 result = "<tr><td>#{link1}</td>" +
                            "<td>#{link2}</td>" +
                            "</tr><tr><td>Cell 21</td><td>#{link3}</td></tr>"
                 @project = Project.find(1)
                 assert_equal "<table>#{result}</table>", textilizable(text).gsub(/[\t\n]/, '')
               end
               def test_text_formatting
                 to_test = {'*_+bold, italic and underline+_*' => '<strong><em><ins>bold, italic and underline</ins></em></strong>',
                            '(_text within parentheses_)' => '(<em>text within parentheses</em>)',
                            'a *Humane Web* Text Generator' => 'a <strong>Humane Web</strong> Text Generator',
                            'a H *umane* W *eb* T *ext* G *enerator*' => 'a H <strong>umane</strong> W <strong>eb</strong> T <strong>ext</strong> G <strong>enerator</strong>',
                            'a *H* umane *W* eb *T* ext *G* enerator' => 'a <strong>H</strong> umane <strong>W</strong> eb <strong>T</strong> ext <strong>G</strong> enerator',
                           }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_wiki_horizontal_rule
                 assert_equal '<hr />', textilizable('---')
                 assert_equal '<p>Dashes: ---</p>', textilizable('Dashes: ---')
               end
               def test_footnotes
                 raw = <<-RAW
             This is some text[1].
             fn1. This is the foot note
             RAW
                 expected = <<-EXPECTED
             <p>This is some text<sup><a href=\"#fn1\">1</a></sup>.</p>
             <p id="fn1" class="footnote"><sup>1</sup> This is the foot note</p>
             EXPECTED
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_headings
                 raw = 'h1. Some heading'
                 expected = %|<a name="Some-heading"></a>\n<h1 >Some heading<a href="#Some-heading" class="wiki-anchor">&para;</a></h1>|
                 assert_equal expected, textilizable(raw)
               end
               def test_headings_with_special_chars
                 # This test makes sure that the generated anchor names match the expected
                 # ones even if the heading text contains unconventional characters
                 raw = 'h1. Some heading related to version 0.5'
                 anchor = sanitize_anchor_name("Some-heading-related-to-version-0.5")
                 expected = %|<a name="#{anchor}"></a>\n<h1 >Some heading related to version 0.5<a href="##{anchor}" class="wiki-anchor">&para;</a></h1>|
                 assert_equal expected, textilizable(raw)
               end
               def test_headings_in_wiki_single_page_export_should_be_prepended_with_page_title
                 page = WikiPage.new( :title => 'Page Title', :wiki_id => 1 )
                 content = WikiContent.new( :text => 'h1. Some heading', :page => page )
                 expected = %|<a name="Page_Title_Some-heading"></a>\n<h1 >Some heading<a href="#Page_Title_Some-heading" class="wiki-anchor">&para;</a></h1>|
                 assert_equal expected, textilizable(content, :text, :wiki_links => :anchor )
               end
               def test_table_of_content
                 raw = <<-RAW
             {{toc}}
             h1. Title
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
             h2. Subtitle with a [[Wiki]] link
             Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
             h2. Subtitle with [[Wiki|another Wiki]] link
             h2. Subtitle with %{color:red}red text%
             <pre>
             some code
             </pre>
             h3. Subtitle with *some* _modifiers_
             h3. Subtitle with @inline code@
             h1. Another title
             h3. An "Internet link":http://www.redmine.org/ inside subtitle
             h2. "Project Name !/attachments/1234/logo_small.gif! !/attachments/5678/logo_2.png!":/projects/projectname/issues
             RAW
                 expected =  '<ul class="toc">' +
                               '<li><a href="#Title">Title</a>' +
                                 '<ul>' +
                                   '<li><a href="#Subtitle-with-a-Wiki-link">Subtitle with a Wiki link</a></li>' +
                                   '<li><a href="#Subtitle-with-another-Wiki-link">Subtitle with another Wiki link</a></li>' +
                                   '<li><a href="#Subtitle-with-red-text">Subtitle with red text</a>' +
                                     '<ul>' +
                                       '<li><a href="#Subtitle-with-some-modifiers">Subtitle with some modifiers</a></li>' +
                                       '<li><a href="#Subtitle-with-inline-code">Subtitle with inline code</a></li>' +
                                     '</ul>' +
                                   '</li>' +
                                 '</ul>' +
                               '</li>' +
                               '<li><a href="#Another-title">Another title</a>' +
                                 '<ul>' +
                                   '<li>' +
                                     '<ul>' +
                                       '<li><a href="#An-Internet-link-inside-subtitle">An Internet link inside subtitle</a></li>' +
                                     '</ul>' +
                                   '</li>' +
                                   '<li><a href="#Project-Name">Project Name</a></li>' +
                                 '</ul>' +
                               '</li>' +
                            '</ul>'
                 @project = Project.find(1)
                 assert textilizable(raw).gsub("\n", "").include?(expected)
               end
               def test_table_of_content_should_generate_unique_anchors
                 raw = <<-RAW
             {{toc}}
             h1. Title
             h2. Subtitle
             h2. Subtitle
             RAW
                 expected =  '<ul class="toc">' +
                               '<li><a href="#Title">Title</a>' +
                                 '<ul>' +
                                   '<li><a href="#Subtitle">Subtitle</a></li>' +
                                   '<li><a href="#Subtitle-2">Subtitle</a></li>' +
                                 '</ul>' +
                               '</li>' +
                             '</ul>'
                 @project = Project.find(1)
                 result = textilizable(raw).gsub("\n", "")
                 assert_include expected, result
                 assert_include '<a name="Subtitle">', result
                 assert_include '<a name="Subtitle-2">', result
               end
               def test_table_of_content_should_contain_included_page_headings
                 raw = <<-RAW
             {{toc}}
             h1. Included
             {{include(Child_1)}}
             RAW
                 expected = '<ul class="toc">' +
                            '<li><a href="#Included">Included</a></li>' +
                            '<li><a href="#Child-page-1">Child page 1</a></li>' +
                            '</ul>'
                 @project = Project.find(1)
                 assert textilizable(raw).gsub("\n", "").include?(expected)
               end
               def test_toc_with_textile_formatting_should_be_parsed
                 with_settings :text_formatting => 'textile' do
                   assert_select_in textilizable("{{toc}}\n\nh1. Heading"), 'ul.toc li', :text => 'Heading'
                   assert_select_in textilizable("{{<toc}}\n\nh1. Heading"), 'ul.toc.left li', :text => 'Heading'
                   assert_select_in textilizable("{{>toc}}\n\nh1. Heading"), 'ul.toc.right li', :text => 'Heading'
                 end
               end
               if Object.const_defined?(:Redcarpet)
               def test_toc_with_markdown_formatting_should_be_parsed
                 with_settings :text_formatting => 'markdown' do
                   assert_select_in textilizable("{{toc}}\n\n# Heading"), 'ul.toc li', :text => 'Heading'
                   assert_select_in textilizable("{{<toc}}\n\n# Heading"), 'ul.toc.left li', :text => 'Heading'
                   assert_select_in textilizable("{{>toc}}\n\n# Heading"), 'ul.toc.right li', :text => 'Heading'
                 end
               end
               end
               def test_section_edit_links
                 raw = <<-RAW
             h1. Title
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
             h2. Subtitle with a [[Wiki]] link
             h2. Subtitle with *some* _modifiers_
             h2. Subtitle with @inline code@
             <pre>
             some code
             h2. heading inside pre
             <h2>html heading inside pre</h2>
             </pre>
             h2. Subtitle after pre tag
             RAW
                 @project = Project.find(1)
                 set_language_if_valid 'en'
                 result = textilizable(raw, :edit_section_links => {:controller => 'wiki', :action => 'edit', :project_id => '1', :id => 'Test'}).gsub("\n", "")
                 # heading that contains inline code
                 assert_match Regexp.new('<div class="contextual heading-2" title="Edit this section" id="section-4">' +
                   '<a class="icon-only icon-edit" href="/projects/1/wiki/Test/edit\?section=4">Edit this section</a></div>' +
                   '<a name="Subtitle-with-inline-code"></a>' +
                   '<h2 >Subtitle with <code>inline code</code><a href="#Subtitle-with-inline-code" class="wiki-anchor">&para;</a></h2>'),
                   result
                 # last heading
                 assert_match Regexp.new('<div class="contextual heading-2" title="Edit this section" id="section-5">' +
                   '<a class="icon-only icon-edit" href="/projects/1/wiki/Test/edit\?section=5">Edit this section</a></div>' +
                   '<a name="Subtitle-after-pre-tag"></a>' +
                   '<h2 >Subtitle after pre tag<a href="#Subtitle-after-pre-tag" class="wiki-anchor">&para;</a></h2>'),
                   result
               end
               def test_default_formatter
                 with_settings :text_formatting => 'unknown' do
                   text = 'a *link*: http://www.example.net/'
                   assert_equal '<p>a *link*: <a class="external" href="http://www.example.net/">http://www.example.net/</a></p>', textilizable(text)
                 end
               end
               def test_parse_redmine_links_should_handle_a_tag_without_attributes
                 text = '<a>http://example.com</a>'
                 expected = text.dup
                 parse_redmine_links(text, nil, nil, nil, true, {})
                 assert_equal expected, text
               end
               def test_due_date_distance_in_words
                 to_test = { Date.today => 'Due in 0 days',
                             Date.today + 1 => 'Due in 1 day',
                             Date.today + 100 => 'Due in about 3 months',
                             Date.today + 20000 => 'Due in over 54 years',
                             Date.today - 1 => '1 day late',
                             Date.today - 100 => 'about 3 months late',
                             Date.today - 20000 => 'over 54 years late',
                            }
                 ::I18n.locale = :en
                 to_test.each do |date, expected|
                   assert_equal expected, due_date_distance_in_words(date)
                 end
               end
               def test_avatar_enabled
                 with_settings :gravatar_enabled => '1' do
                   assert avatar(User.find_by_mail('jsmith@somenet.foo')).include?(Digest::MD5.hexdigest('jsmith@somenet.foo'))
                   assert avatar('jsmith <jsmith@somenet.foo>').include?(Digest::MD5.hexdigest('jsmith@somenet.foo'))
                   # Default size is 50
                   assert avatar('jsmith <jsmith@somenet.foo>').include?('size=50')
                   assert avatar('jsmith <jsmith@somenet.foo>', :size => 24).include?('size=24')
                   # Non-avatar options should be considered html options
                   assert avatar('jsmith <jsmith@somenet.foo>', :title => 'John Smith').include?('title="John Smith"')
                   # The default class of the img tag should be gravatar
                   assert avatar('jsmith <jsmith@somenet.foo>').include?('class="gravatar"')
                   assert !avatar('jsmith <jsmith@somenet.foo>', :class => 'picture').include?('class="gravatar"')
                   assert_nil avatar('jsmith')
                   assert_nil avatar(nil)
                 end
               end
               def test_avatar_disabled
                 with_settings :gravatar_enabled => '0' do
                   assert_equal '', avatar(User.find_by_mail('jsmith@somenet.foo'))
                 end
               end
               def test_link_to_user
                 user = User.find(2)
                 result = link_to("John Smith", "/users/2", :class => "user active")
                 assert_equal result, link_to_user(user)
               end
               def test_link_to_user_should_not_link_to_locked_user
                 with_current_user nil do
                   user = User.find(5)
                   assert user.locked?
                   assert_equal 'Dave2 Lopper2', link_to_user(user)
                 end
               end
               def test_link_to_user_should_link_to_locked_user_if_current_user_is_admin
                 with_current_user User.find(1) do
                   user = User.find(5)
                   assert user.locked?
                   result = link_to("Dave2 Lopper2", "/users/5", :class => "user locked")
                   assert_equal result, link_to_user(user)
                 end
               end
               def test_link_to_user_should_not_link_to_anonymous
                 user = User.anonymous
                 assert user.anonymous?
                 t = link_to_user(user)
                 assert_equal ::I18n.t(:label_user_anonymous), t
               end
               def test_link_to_attachment
                 a = Attachment.find(3)
                 assert_equal '<a href="/attachments/3/logo.gif">logo.gif</a>',
                   link_to_attachment(a)
                 assert_equal '<a href="/attachments/3/logo.gif">Text</a>',
                   link_to_attachment(a, :text => 'Text')
                 result = link_to("logo.gif", "/attachments/3/logo.gif", :class => "foo")
                 assert_equal result,
                   link_to_attachment(a, :class => 'foo')
                 assert_equal '<a href="/attachments/download/3/logo.gif">logo.gif</a>',
                   link_to_attachment(a, :download => true)
                 assert_equal '<a href="http://test.host/attachments/3/logo.gif">logo.gif</a>',
                   link_to_attachment(a, :only_path => false)
               end
               def test_thumbnail_tag
                 a = Attachment.find(3)
                 assert_select_in thumbnail_tag(a),
                   'a[href=?][title=?] img[alt="3"][src=?]',
                   "/attachments/3/logo.gif", "logo.gif", "/attachments/thumbnail/3"
               end
               def test_link_to_project
                 project = Project.find(1)
                 assert_equal %(<a href="/projects/ecookbook">eCookbook</a>),
                              link_to_project(project)
                 assert_equal %(<a href="http://test.host/projects/ecookbook?jump=blah">eCookbook</a>),
                              link_to_project(project, {:only_path => false, :jump => 'blah'})
               end
               def test_link_to_project_settings
                 project = Project.find(1)
                 assert_equal '<a href="/projects/ecookbook/settings">eCookbook</a>', link_to_project_settings(project)
                 project.status = Project::STATUS_CLOSED
                 assert_equal '<a href="/projects/ecookbook">eCookbook</a>', link_to_project_settings(project)
                 project.status = Project::STATUS_ARCHIVED
                 assert_equal 'eCookbook', link_to_project_settings(project)
               end
               def test_link_to_legacy_project_with_numerical_identifier_should_use_id
                 # numeric identifier are no longer allowed
                 Project.where(:id => 1).update_all(:identifier => 25)
                 assert_equal '<a href="/projects/1">eCookbook</a>',
                              link_to_project(Project.find(1))
               end
               def test_principals_options_for_select_with_users
                 User.current = nil
                 users = [User.find(2), User.find(4)]
                 assert_equal %(<option value="2">John Smith</option><option value="4">Robert Hill</option>),
                   principals_options_for_select(users)
               end
               def test_principals_options_for_select_with_selected
                 User.current = nil
                 users = [User.find(2), User.find(4)]
                 assert_equal %(<option value="2">John Smith</option><option value="4" selected="selected">Robert Hill</option>),
                   principals_options_for_select(users, User.find(4))
               end
               def test_principals_options_for_select_with_users_and_groups
                 User.current = nil
                 set_language_if_valid 'en'
                 users = [User.find(2), Group.find(11), User.find(4), Group.find(10)]
                 assert_equal %(<option value="2">John Smith</option><option value="4">Robert Hill</option>) +
                   %(<optgroup label="Groups"><option value="10">A Team</option><option value="11">B Team</option></optgroup>),
                   principals_options_for_select(users)
               end
               def test_principals_options_for_select_with_empty_collection
                 assert_equal '', principals_options_for_select([])
               end
               def test_principals_options_for_select_should_include_me_option_when_current_user_is_in_collection
                 set_language_if_valid 'en'
                 users = [User.find(2), User.find(4)]
                 User.current = User.find(4)
                 assert_include '<option value="4">&lt;&lt; me &gt;&gt;</option>', principals_options_for_select(users)
               end
               def test_stylesheet_link_tag_should_pick_the_default_stylesheet
                 assert_match 'href="/stylesheets/styles.css"', stylesheet_link_tag("styles")
               end
               def test_stylesheet_link_tag_for_plugin_should_pick_the_plugin_stylesheet
                 assert_match 'href="/plugin_assets/foo/stylesheets/styles.css"', stylesheet_link_tag("styles", :plugin => :foo)
               end
               def test_image_tag_should_pick_the_default_image
                 assert_match 'src="/images/image.png"', image_tag("image.png")
               end
               def test_image_tag_should_pick_the_theme_image_if_it_exists
                 theme = Redmine::Themes.themes.last
                 theme.images << 'image.png'
                 with_settings :ui_theme => theme.id do
                   assert_match %|src="/themes/#{theme.dir}/images/image.png"|, image_tag("image.png")
                   assert_match %|src="/images/other.png"|, image_tag("other.png")
                 end
               ensure
                 theme.images.delete 'image.png'
               end
               def test_image_tag_sfor_plugin_should_pick_the_plugin_image
                 assert_match 'src="/plugin_assets/foo/images/image.png"', image_tag("image.png", :plugin => :foo)
               end
               def test_javascript_include_tag_should_pick_the_default_javascript
                 assert_match 'src="/javascripts/scripts.js"', javascript_include_tag("scripts")
               end
               def test_javascript_include_tag_for_plugin_should_pick_the_plugin_javascript
                 assert_match 'src="/plugin_assets/foo/javascripts/scripts.js"', javascript_include_tag("scripts", :plugin => :foo)
               end
               def test_raw_json_should_escape_closing_tags
                 s = raw_json(["<foo>bar</foo>"])
                 assert_include '\/foo', s
               end
               def test_raw_json_should_be_html_safe
                 s = raw_json(["foo"])
                 assert s.html_safe?
               end
               def test_html_title_should_app_title_if_not_set
                 assert_equal 'Redmine', html_title
               end
               def test_html_title_should_join_items
                 html_title 'Foo', 'Bar'
                 assert_equal 'Foo - Bar - Redmine', html_title
               end
               def test_html_title_should_append_current_project_name
                 @project = Project.find(1)
                 html_title 'Foo', 'Bar'
                 assert_equal 'Foo - Bar - eCookbook - Redmine', html_title
               end
               def test_title_should_return_a_h2_tag
                 assert_equal '<h2>Foo</h2>', title('Foo')
               end
               def test_title_should_set_html_title
                 title('Foo')
                 assert_equal 'Foo - Redmine', html_title
               end
               def test_title_should_turn_arrays_into_links
                 assert_equal '<h2><a href="/foo">Foo</a></h2>', title(['Foo', '/foo'])
                 assert_equal 'Foo - Redmine', html_title
               end
               def test_title_should_join_items
                 assert_equal '<h2>Foo &#187; Bar</h2>', title('Foo', 'Bar')
                 assert_equal 'Bar - Foo - Redmine', html_title
               end
               def test_favicon_path
                 assert_match %r{^/favicon\.ico}, favicon_path
               end
               def test_favicon_path_with_suburi
                 Redmine::Utils.relative_url_root = '/foo'
                 assert_match %r{^/foo/favicon\.ico}, favicon_path
               ensure
                 Redmine::Utils.relative_url_root = ''
               end
               def test_favicon_url
                 assert_match %r{^http://test\.host/favicon\.ico}, favicon_url
               end
               def test_favicon_url_with_suburi
                 Redmine::Utils.relative_url_root = '/foo'
                 assert_match %r{^http://test\.host/foo/favicon\.ico}, favicon_url
               ensure
                 Redmine::Utils.relative_url_root = ''
               end
               def test_truncate_single_line
                 str = "01234"
                 result = truncate_single_line_raw("#{str}\n#{str}", 10)
                 assert_equal "01234 0...", result
                 assert !result.html_safe?
                 result = truncate_single_line_raw("#{str}<&#>\n#{str}#{str}", 16)
                 assert_equal "01234<&#> 012...", result
                 assert !result.html_safe?
               end
               def test_truncate_single_line_non_ascii
                 ja = "\xe6\x97\xa5\xe6\x9c\xac\xe8\xaa\x9e".force_encoding('UTF-8')
                 result = truncate_single_line_raw("#{ja}\n#{ja}\n#{ja}", 10)
                 assert_equal "#{ja} #{ja}...", result
                 assert !result.html_safe?
               end
             end

test/unit/lib/redmine/field_format/field_format_test.rb +15 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../../../test_helper', __FILE__)
             class Redmine::FieldFormatTest < ActionView::TestCase
               include ApplicationHelper
+              def setup
+                set_language_if_valid 'en'
+              end
               def test_string_field_with_text_formatting_disabled_should_not_format_text
                 field = IssueCustomField.new(:field_format => 'string')
                 custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "*foo*")
                 assert_equal "*foo*", field.format.formatted_custom_value(self, custom_value, false)
                 assert_equal "*foo*", field.format.formatted_custom_value(self, custom_value, true)
               end
               def test_string_field_with_text_formatting_enabled_should_format_text
                 field = IssueCustomField.new(:field_format => 'string', :text_formatting => 'full')
                 custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "*foo*")
                 assert_equal "*foo*", field.format.formatted_custom_value(self, custom_value, false)
                 assert_include "<strong>foo</strong>", field.format.formatted_custom_value(self, custom_value, true)
               end
               def test_text_field_with_text_formatting_disabled_should_not_format_text
                 field = IssueCustomField.new(:field_format => 'text')
                 custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "*foo*\nbar")
                 assert_equal "*foo*\nbar", field.format.formatted_custom_value(self, custom_value, false)
                 assert_include "*foo*\n<br />bar", field.format.formatted_custom_value(self, custom_value, true)
               end
               def test_text_field_with_text_formatting_enabled_should_format_text
                 field = IssueCustomField.new(:field_format => 'text', :text_formatting => 'full')
                 custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "*foo*\nbar")
                 assert_equal "*foo*\nbar", field.format.formatted_custom_value(self, custom_value, false)
                 assert_include "<strong>foo</strong>", field.format.formatted_custom_value(self, custom_value, true)
               end
+              def test_should_validate_url_pattern_with_safe_scheme
+                field = IssueCustomField.new(:field_format => 'string', :name => 'URL', :url_pattern => 'http://foo/%value%')
+                assert_save field
+              end
+              def test_should_not_validate_url_pattern_with_unsafe_scheme
+                field = IssueCustomField.new(:field_format => 'string', :name => 'URL', :url_pattern => 'foo://foo/%value%')
+                assert !field.save
+                assert_include "URL is invalid", field.errors.full_messages
+              end
               def test_text_field_with_url_pattern_should_format_as_link
                 field = IssueCustomField.new(:field_format => 'string', :url_pattern => 'http://foo/%value%')
                 custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "bar")
                 assert_equal "bar", field.format.formatted_custom_value(self, custom_value, false)
                 assert_equal '<a href="http://foo/bar">bar</a>', field.format.formatted_custom_value(self, custom_value, true)
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages