discourse

Author SHA1 Message Date

Author	SHA1	Message	Date
Roman Rizzi	df3eb93973	DEV: Sanitize HTML admin inputs (#14681 ) * DEV: Sanitize HTML admin inputs This PR adds on-save HTML sanitization for: Client site settings translation overrides badges descriptions user fields descriptions I used Rails's SafeListSanitizer, which [accepts the following HTML tags and attributes](`018cf54073/lib/rails/html/sanitizer.rb (L108)`) * Make sure that the sanitization logic doesn't corrupt settings with special characters	2021-10-27 11:33:07 -03:00
Sam Saffron	4ea21fa2d0	DEV: use #frozen_string_literal: true on all spec This change both speeds up specs (less strings to allocate) and helps catch cases where methods in Discourse are mutating inputs. Overall we will be migrating everything to use #frozen_string_literal: true it will take a while, but this is the first and safest move in this direction	2019-04-30 10:27:42 +10:00
Maja Komel	65f3ed0689	UX: make name optional for confirmation user field (#7149 )	2019-03-13 18:40:43 +01:00

Roman Rizzi

df3eb93973

DEV: Sanitize HTML admin inputs (#14681 )

* DEV: Sanitize HTML admin inputs

This PR adds on-save HTML sanitization for:

Client site settings
translation overrides
badges descriptions
user fields descriptions

I used Rails's SafeListSanitizer, which [accepts the following HTML tags and attributes](018cf54073/lib/rails/html/sanitizer.rb (L108))

* Make sure that the sanitization logic doesn't corrupt settings with special characters

2021-10-27 11:33:07 -03:00

Sam Saffron

4ea21fa2d0

DEV: use #frozen_string_literal: true on all spec

This change both speeds up specs (less strings to allocate) and helps catch
cases where methods in Discourse are mutating inputs.

Overall we will be migrating everything to use #frozen_string_literal: true
it will take a while, but this is the first and safest move in this direction

2019-04-30 10:27:42 +10:00

Maja Komel 65f3ed0689 UX: make name optional for confirmation user field (#7149 ) 2019-03-13 18:40:43 +01:00

3 Commits