From 1218a5e630f7ca6d1f1bb58d1ad1fef0974c70ad Mon Sep 17 00:00:00 2001
From: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Date: Fri, 11 Jul 2014 00:07:20 +0300
Subject: [PATCH] Add html_escape to project description. auto_link set
 description to html_safe but! dont escape html :(.

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
---
 app/views/projects/_home_panel.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/projects/_home_panel.html.haml b/app/views/projects/_home_panel.html.haml
index 2a97cb4903..ddf815ebd9 100644
--- a/app/views/projects/_home_panel.html.haml
+++ b/app/views/projects/_home_panel.html.haml
@@ -17,7 +17,7 @@
     .col-md-7
       .project-home-desc
         - if @project.description.present?
-          = auto_link @project.description, link: :urls
+          = auto_link ERB::Util.html_escape(@project.description), link: :urls
         - if can?(current_user, :admin_project, @project)
           &ndash;
           %strong= link_to 'Edit', edit_project_path