FIX: do not escape slash for category text description (#20460)
Original solution to use `description` instead of `text_description` was wrong: https://github.com/discourse/discourse/pull/20436 Problem is that we have to escape HTML tags. However, we would like to use escape method which is keep `/` intact. Expected behavior is given by ERB::Util.html_escape instead of Rack::Utils.escape_html /t/92015
This commit is contained in:
parent
52d4de7b45
commit
d92fd30d23
|
@ -131,7 +131,7 @@ export default class CategorySectionLink {
|
||||||
}
|
}
|
||||||
|
|
||||||
get title() {
|
get title() {
|
||||||
return this.category.description;
|
return this.category.description_text;
|
||||||
}
|
}
|
||||||
|
|
||||||
get text() {
|
get text() {
|
||||||
|
|
|
@ -615,7 +615,7 @@ acceptance("Sidebar - Logged on user - Categories Section", function (needs) {
|
||||||
|
|
||||||
assert.strictEqual(
|
assert.strictEqual(
|
||||||
query(`.sidebar-section-link[data-category-id="${category.id}"]`).title,
|
query(`.sidebar-section-link[data-category-id="${category.id}"]`).title,
|
||||||
category.description,
|
category.description_text,
|
||||||
"category description without HTML entity is used as the link's title"
|
"category description without HTML entity is used as the link's title"
|
||||||
);
|
);
|
||||||
});
|
});
|
||||||
|
|
|
@ -388,7 +388,7 @@ class Category < ActiveRecord::Base
|
||||||
@@cache_text ||= LruRedux::ThreadSafeCache.new(1000)
|
@@cache_text ||= LruRedux::ThreadSafeCache.new(1000)
|
||||||
@@cache_text.getset(self.description) do
|
@@cache_text.getset(self.description) do
|
||||||
text = Nokogiri::HTML5.fragment(self.description).text.strip
|
text = Nokogiri::HTML5.fragment(self.description).text.strip
|
||||||
Rack::Utils.escape_html(text).html_safe
|
ERB::Util.html_escape(text).html_safe
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -18,6 +18,6 @@ RSpec.describe CategoryBadge do
|
||||||
c = Fabricate(:category, description: '<code>\' <b id="x"></code>')
|
c = Fabricate(:category, description: '<code>\' <b id="x"></code>')
|
||||||
html = CategoryBadge.html_for(c)
|
html = CategoryBadge.html_for(c)
|
||||||
|
|
||||||
expect(html).to include("title='' <b id="x">'")
|
expect(html).to include("title='' <b id="x">'")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -400,8 +400,8 @@ RSpec.describe Category do
|
||||||
it "correctly generates text description as needed" do
|
it "correctly generates text description as needed" do
|
||||||
c = Category.new
|
c = Category.new
|
||||||
expect(c.description_text).to be_nil
|
expect(c.description_text).to be_nil
|
||||||
c.description = "<hello <a>test</a>."
|
c.description = "<hello <a>foo/bar</a>."
|
||||||
expect(c.description_text).to eq("<hello test.")
|
expect(c.description_text).to eq("<hello foo/bar.")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue