github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-14 19:29:21 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: strip HTML tags in topic title in email digest

Browse Source
This commit is contained in:
Arpit Jalan
2016-03-08 20:08:23 +05:30
parent 6c1d5b8cd3
commit dde91a54dc
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/helpers/application_helper.rb
View File

@ -74,8 +74,9 @@ module ApplicationHelper
end end
end end
def unescape_emoji(title) def format_topic_title(title)
PrettyText.unescape_emoji(title) PrettyText.unescape_emoji(title)
strip_tags(title)
end end
def with_format(format, &block) def with_format(format, &block)

4
app/views/user_notifications/digest.html.erb
View File

@ -20,7 +20,7 @@
<%- @featured_topics.each_with_index do |t, i| %> <%- @featured_topics.each_with_index do |t, i| %>
<div class='featured-topic'> <div class='featured-topic'>
<a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw unescape_emoji(t.title) %></a> <a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw format_topic_title(t.title) %></a>
<br/> <br/>
<%= category_badge(t.category, inline_style: true, absolute_url: true) %> <%= category_badge(t.category, inline_style: true, absolute_url: true) %>
</div> </div>
@ -43,7 +43,7 @@
<%- @new_topics.each do |t| %> <%- @new_topics.each do |t| %>
<ul> <ul>
<li> <li>
<a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw unescape_emoji(t.title) %></a> <a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw format_topic_title(t.title) %></a>
<span class='post-count'><%= t.posts_count %></span> <span class='post-count'><%= t.posts_count %></span>
<%= category_badge(t.category, inline_style: true, absolute_url: true) %> <%= category_badge(t.category, inline_style: true, absolute_url: true) %>
</li> </li>