jro_apps/redmine Commit - r1598:9703f576d96c

Escapes HTML tags....

Jean-Philippe Lang -

r1598:9703f576d96c

parent child

Context file:

r1598:9703f576d96c

Collapse all files

app/views/account/show.rhtml +3 -3

             <h2><%=h @user.name %></h2>
             <p>
-            <%= mail_to @user.mail unless @user.pref.hide_mail %>
+            <%= mail_to(h(@user.mail)) unless @user.pref.hide_mail %>
             <ul>
                 <li><%=l(:label_registered_on)%>: <%= format_date(@user.created_on) %></li>
             <% for custom_value in @custom_values %>
             <% if !custom_value.value.empty? %>
                 <li><%= custom_value.custom_field.name%>: <%=h show_value(custom_value) %></li>
             <% end %>
             <% end %>
             </ul>
             </p>
             <% unless @memberships.empty? %>
             <h3><%=l(:label_project_plural)%></h3>
             <ul>
             <% for membership in @memberships %>
-            	<li><%= link_to membership.project.name, :controller => 'projects', :action => 'show', :id => membership.project %>
+            	<li><%= link_to(h(membership.project.name), :controller => 'projects', :action => 'show', :id => membership.project) %>
-                (<%= membership.role.name %>, <%= format_date(membership.created_on) %>)</li>
+                (<%=h membership.role.name %>, <%= format_date(membership.created_on) %>)</li>
             <% end %>
             </ul>
             <% end %>
             <h3><%=l(:label_activity)%></h3>
             <p>
             <%=l(:label_reported_issues)%>: <%= Issue.count(:conditions => ["author_id=?", @user.id]) %>
             </p>

app/views/projects/show.rhtml +1 -1

             <h2><%=l(:label_overview)%></h2>
             <div class="splitcontentleft">
             	<%= textilizable @project.description %>
             	<ul>
-            	<% unless @project.homepage.blank? %><li><%=l(:field_homepage)%>: <%= auto_link @project.homepage %></li><% end %>
+            	<% unless @project.homepage.blank? %><li><%=l(:field_homepage)%>: <%= auto_link(h(@project.homepage)) %></li><% end %>
                 <% if @subprojects.any? %>
              	<li><%=l(:label_subproject_plural)%>: <%= @subprojects.collect{|p| link_to(h(p.name), :action => 'show', :id => p)}.join(", ") %></li>
                 <% end %>
             	<% if @project.parent %>
             	<li><%=l(:field_parent)%>: <%= link_to h(@project.parent.name), :controller => 'projects', :action => 'show', :id => @project.parent %></li>
             	<% end %>
             	<% @project.custom_values.each do |custom_value| %>
             	<% if !custom_value.value.empty? %>
             	   <li><%= custom_value.custom_field.name%>: <%=h show_value(custom_value) %></li>
             	<% end %>
             	<% end %>
             	</ul>
               <% if User.current.allowed_to?(:view_issues, @project) %>
               <div class="box">
                 <h3 class="icon22 icon22-tracker"><%=l(:label_issue_tracking)%></h3>
                 <ul>
                 <% for tracker in @trackers %>
                   <li><%= link_to tracker.name, :controller => 'issues', :action => 'index', :project_id => @project,
                                                             :set_filter => 1,
                                                             "tracker_id" => tracker.id %>:
                   <%= @open_issues_by_tracker[tracker] || 0 %> <%= lwr(:label_open_issues, @open_issues_by_tracker[tracker] || 0) %>
                   <%= l(:label_on) %> <%= @total_issues_by_tracker[tracker] || 0 %></li>
                 <% end %>
                 </ul>
                 <p><%= link_to l(:label_issue_view_all), :controller => 'issues', :action => 'index', :project_id => @project, :set_filter => 1 %></p>
               </div>
               <% end %>
             </div>
             <div class="splitcontentright">
                 <% if @members_by_role.any? %>
             	<div class="box">
             		<h3 class="icon22 icon22-users"><%=l(:label_member_plural)%></h3>
             		<p><% @members_by_role.keys.sort.each do |role| %>
             		<%= role.name %>:
             		<%= @members_by_role[role].collect(&:user).sort.collect{|u| link_to_user u}.join(", ") %>
             		<br />
             		<% end %></p>
             	</div>
             	<% end %>
               <% if @news.any? && authorize_for('news', 'index') %>
               <div class="box">
                 <h3><%=l(:label_news_latest)%></h3>
                 <%= render :partial => 'news/news', :collection => @news %>
                 <p><%= link_to l(:label_news_view_all), :controller => 'news', :action => 'index', :project_id => @project %></p>
               </div>
               <% end %>
             </div>
             <% content_for :sidebar do %>
                 <% planning_links = []
                   planning_links << link_to_if_authorized(l(:label_calendar), :action => 'calendar', :id => @project)
                   planning_links << link_to_if_authorized(l(:label_gantt), :action => 'gantt', :id => @project)
                   planning_links.compact!
                   unless planning_links.empty? %>
                 <h3><%= l(:label_planning) %></h3>
                 <p><%= planning_links.join(' | ') %></p>
                 <% end %>
                 <% if @total_hours && User.current.allowed_to?(:view_time_entries, @project) %>
                 <h3><%= l(:label_spent_time) %></h3>
                 <p><span class="icon icon-time"><%= lwr(:label_f_hour, @total_hours) %></span></p>
                 <p><%= link_to(l(:label_details), {:controller => 'timelog', :action => 'details', :project_id => @project}) %> |
                 <%= link_to(l(:label_report), {:controller => 'timelog', :action => 'report', :project_id => @project}) %></p>
                 <% end %>
             <% end %>
             <% content_for :header_tags do %>
             <%= auto_discovery_link_tag(:atom, {:action => 'activity', :id => @project, :format => 'atom', :key => User.current.rss_key}) %>
             <% end %>
             <% html_title(l(:label_overview)) -%>

app/views/users/list.rhtml +4 -4

             <div class="contextual">
             <%= link_to l(:label_user_new), {:action => 'add'}, :class => 'icon icon-add' %>
             </div>
             <h2><%=l(:label_user_plural)%></h2>
             <% form_tag({}, :method => :get) do %>
             <fieldset><legend><%= l(:label_filter_plural) %></legend>
             <label><%= l(:field_status) %> :</label>
             <%= select_tag 'status', status_options_for_select(@status), :class => "small", :onchange => "this.form.submit(); return false;"  %>
             </fieldset>
             <% end %>
             &nbsp;
             <table class="list">
               <thead><tr>
             	<%= sort_header_tag('login', :caption => l(:field_login)) %>
             	<%= sort_header_tag('firstname', :caption => l(:field_firstname)) %>
             	<%= sort_header_tag('lastname', :caption => l(:field_lastname)) %>
             	<%= sort_header_tag('mail', :caption => l(:field_mail)) %>
             	<%= sort_header_tag('admin', :caption => l(:field_admin), :default_order => 'desc') %>
             	<%= sort_header_tag('created_on', :caption => l(:field_created_on), :default_order => 'desc') %>
             	<%= sort_header_tag('last_login_on', :caption => l(:field_last_login_on), :default_order => 'desc') %>
                 <th></th>
               </tr></thead>
               <tbody>
             <% for user in @users -%>
               <tr class="user <%= cycle("odd", "even") %> <%= %w(anon active registered locked)[user.status] %>">
-            	<td class="username"><%= link_to user.login, :action => 'edit', :id => user %></td>
+            	<td class="username"><%= link_to h(user.login), :action => 'edit', :id => user %></td>
-            	<td class="firstname"><%= user.firstname %></td>
+            	<td class="firstname"><%= h(user.firstname) %></td>
-            	<td class="lastname"><%= user.lastname %></td>
+            	<td class="lastname"><%= h(user.lastname) %></td>
-            	<td class="email"><%= user.mail %></td>
+            	<td class="email"><%= h(user.mail) %></td>
             	<td align="center"><%= image_tag('true.png') if user.admin? %></td>
             	<td class="created_on" align="center"><%= format_time(user.created_on) %></td>
             	<td class="last_login_on" align="center"><%= format_time(user.last_login_on) unless user.last_login_on.nil? %></td>
                 <td><small><%= change_status_link(user) %></small></td>
               </tr>
             <% end -%>
               </tbody>
             </table>
             <p class="pagination"><%= pagination_links_full @user_pages, @user_count %></p>
             <% html_title(l(:label_user_plural)) -%>

app/views/welcome/index.rhtml +1 -1

             <h2><%= l(:label_home) %></h2>
             <div class="splitcontentleft">
               <%= textilizable Setting.welcome_text %>
               <% if @news.any? %>
               <div class="box">
             	<h3><%=l(:label_news_latest)%></h3>
             		<%= render :partial => 'news/news', :collection => @news %>
             		<%= link_to l(:label_news_view_all), :controller => 'news' %>
               </div>
               <% end %>
             </div>
             <div class="splitcontentright">
                 <% if @projects.any? %>
             	<div class="box">
             	<h3 class="icon22 icon22-projects"><%=l(:label_project_latest)%></h3>
             		<ul>
             		<% for project in @projects %>
             			<li>
-            			<%= link_to project.name, :controller => 'projects', :action => 'show', :id => project %> (<%= format_time(project.created_on) %>)
+            			<%= link_to h(project.name), :controller => 'projects', :action => 'show', :id => project %> (<%= format_time(project.created_on) %>)
             			<%= textilizable project.short_description, :project => project %>
             			</li>
             		<% end %>
             		</ul>
             	</div>
             	<% end %>
             </div>
             <% content_for :header_tags do %>
             <%= auto_discovery_link_tag(:atom, {:controller => 'news', :action => 'index', :key => User.current.rss_key, :format => 'atom'},
                                                :title => "#{Setting.app_title}: #{l(:label_news_latest)}") %>
             <%= auto_discovery_link_tag(:atom, {:controller => 'projects', :action => 'activity', :key => User.current.rss_key, :format => 'atom'},
                                                :title => "#{Setting.app_title}: #{l(:label_activity)}") %>
             <% end %>

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages