Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SECURITY: strip HTML tags in topic title in email digest

This commit is contained in:
Arpit Jalan 2016-03-08 20:08:23 +05:30
parent 6c1d5b8cd3
commit dde91a54dc
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/helpers/application_helper.rb
View File

@ -74,8 +74,9 @@ module ApplicationHelper
end
end
def unescape_emoji(title)
def format_topic_title(title)
PrettyText.unescape_emoji(title)
strip_tags(title)
end
def with_format(format, &block)

4
app/views/user_notifications/digest.html.erb
View File

@ -20,7 +20,7 @@
<%- @featured_topics.each_with_index do |t, i| %>
<div class='featured-topic'>
<a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw unescape_emoji(t.title) %></a>
<a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw format_topic_title(t.title) %></a>
<br/>
<%= category_badge(t.category, inline_style: true, absolute_url: true) %>
</div>
@ -43,7 +43,7 @@
<%- @new_topics.each do |t| %>
<ul>
<li>
<a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw unescape_emoji(t.title) %></a>
<a href='<%= Discourse.base_url + t.relative_url %>' style='color: #<%= @anchor_color %>'><%= raw format_topic_title(t.title) %></a>
<span class='post-count'><%= t.posts_count %></span>
<%= category_badge(t.category, inline_style: true, absolute_url: true) %>
</li>