FIX: do not escape slash for category text description (#20460)
Original solution to use `description` instead of `text_description` was wrong: https://github.com/discourse/discourse/pull/20436 Problem is that we have to escape HTML tags. However, we would like to use escape method which is keep `/` intact. Expected behavior is given by ERB::Util.html_escape instead of Rack::Utils.escape_html /t/92015
This commit is contained in:
parent
52d4de7b45
commit
d92fd30d23
|
@ -131,7 +131,7 @@ export default class CategorySectionLink {
|
|||
}
|
||||
|
||||
get title() {
|
||||
return this.category.description;
|
||||
return this.category.description_text;
|
||||
}
|
||||
|
||||
get text() {
|
||||
|
|
|
@ -615,7 +615,7 @@ acceptance("Sidebar - Logged on user - Categories Section", function (needs) {
|
|||
|
||||
assert.strictEqual(
|
||||
query(`.sidebar-section-link[data-category-id="${category.id}"]`).title,
|
||||
category.description,
|
||||
category.description_text,
|
||||
"category description without HTML entity is used as the link's title"
|
||||
);
|
||||
});
|
||||
|
|
|
@ -388,7 +388,7 @@ class Category < ActiveRecord::Base
|
|||
@@cache_text ||= LruRedux::ThreadSafeCache.new(1000)
|
||||
@@cache_text.getset(self.description) do
|
||||
text = Nokogiri::HTML5.fragment(self.description).text.strip
|
||||
Rack::Utils.escape_html(text).html_safe
|
||||
ERB::Util.html_escape(text).html_safe
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -18,6 +18,6 @@ RSpec.describe CategoryBadge do
|
|||
c = Fabricate(:category, description: '<code>\' <b id="x"></code>')
|
||||
html = CategoryBadge.html_for(c)
|
||||
|
||||
expect(html).to include("title='' <b id="x">'")
|
||||
expect(html).to include("title='' <b id="x">'")
|
||||
end
|
||||
end
|
||||
|
|
|
@ -400,8 +400,8 @@ RSpec.describe Category do
|
|||
it "correctly generates text description as needed" do
|
||||
c = Category.new
|
||||
expect(c.description_text).to be_nil
|
||||
c.description = "<hello <a>test</a>."
|
||||
expect(c.description_text).to eq("<hello test.")
|
||||
c.description = "<hello <a>foo/bar</a>."
|
||||
expect(c.description_text).to eq("<hello foo/bar.")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
Loading…
Reference in New Issue