home/gitlabhq
2
0
Fork 0
mirror of https://github.com/wahyd4/gitlabhq.git synced 2026-08-13 22:59:19 +10:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'prevent-html-injection' into 'master'

Browse Source 
Prevent html injection

Commits page renders commit description with single_format method which allows html tags. So commit message with html tags brokers Commits page. See screenshot

![Screenshot 2014-07-10 11.16.40](https://dev.gitlab.org/uploads/gitlab/gitlabhq/6606e1bac0/Screenshot_2014-07-10_11.16.40.png)

See merge request !959
This commit is contained in:
Dmitriy Zaporozhets
2014-07-10 09:16:48 +00:00
parent 4fb5a39dc0 53a8d50b2b
commit a338954c33
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/assets/stylesheets/sections/commits.scss
+10 -2
View File
@@ -177,10 +177,18 @@ li.commit {
.commit-row-description {
font-size: 14px;
border-left: 1px solid #e5e5e5;
padding: 0 15px 0 7px;
border-left: 1px solid #EEE;
padding: 10px 15px;
margin: 5px 0 10px 5px;
background: #f9f9f9;
display: none;
pre {
border: none;
background: inherit;
padding: 0;
margin: 0;
}
}
.commit-row-info {
app/views/projects/commits/_commit.html.haml
+2 -1
View File
@@ -22,7 +22,8 @@
- if commit.description?
.commit-row-description.js-toggle-content
= simple_format(commit.description)
%pre
= commit.description
.commit-row-info
= commit_author_link(commit, avatar: true, size: 16)