myexperiment-hackers
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[myexperiment-hackers] [3577] trunk/app: Fixed some XSS vulnerabilities


From: noreply
Subject: [myexperiment-hackers] [3577] trunk/app: Fixed some XSS vulnerabilities
Date: Fri, 31 May 2013 14:25:15 +0000 (UTC)

Revision
3577
Author
fbacall
Date
2013-05-31 14:25:14 +0000 (Fri, 31 May 2013)

Log Message

Fixed some XSS vulnerabilities

Modified Paths

Diff

Modified: trunk/app/helpers/application_helper.rb (3576 => 3577)


--- trunk/app/helpers/application_helper.rb	2013-05-29 13:04:17 UTC (rev 3576)
+++ trunk/app/helpers/application_helper.rb	2013-05-31 14:25:14 UTC (rev 3577)
@@ -90,7 +90,7 @@
       return nil
     end
     
-    name = truncate_to ? truncate(user.name, :length => truncate_to) : name = user.name
+    name = truncate_to ? truncate(user.name, :length => truncate_to) : user.name
     
     return link_to(h(name), user_url(user), :title => tooltip_title_attrib(h(user.name)))
   end

Modified: trunk/app/views/content/_index.rhtml (3576 => 3577)


--- trunk/app/views/content/_index.rhtml	2013-05-29 13:04:17 UTC (rev 3576)
+++ trunk/app/views/content/_index.rhtml	2013-05-31 14:25:14 UTC (rev 3577)
@@ -35,7 +35,7 @@
                   <input class='checkbox' type='checkbox'  <% if object[:selected] %> checked='checked' <% end %> />
                   <a href="" url_with_params(request.path, object[:label_uri]) -%>">
                     <div class='count'><%= object[:count] -%></div>
-                    <div class='label'><span class='truncate'><%= object[:label] -%></span></div>
+                    <div class='label'><span class='truncate'><%= h(object[:label]) -%></span></div>
                   </a>
                 </div>
               <% end %>

Modified: trunk/app/views/contributions/_versions.rhtml (3576 => 3577)


--- trunk/app/views/contributions/_versions.rhtml	2013-05-29 13:04:17 UTC (rev 3576)
+++ trunk/app/views/contributions/_versions.rhtml	2013-05-31 14:25:14 UTC (rev 3577)
@@ -4,7 +4,7 @@
   <% resource.versions.each do |version| %>
     <li>
       <div class="title">
-        <%= link_to(version.title, send(path, resource, version.version)) %>
+        <%= link_to(h(version.title), send(path, resource, version.version)) %>
       </div>
       <div class="metadata">
 

reply via email to

[Prev in Thread] Current Thread [Next in Thread]