Andreas/tracks
1
0
Fork 0
mirror of https://github.com/TracksApp/tracks.git synced 2026-02-26 00:54:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sanitize output well, but entity-ize < and > in notes

Browse source 
Coming from a rich message or API call, notes can contain HTML and it
will render to the browser. Coming from a normal todo creation, though,
all < and > characters will be replaced with the corresponding entities.
This preserves HTML emails, but prevents users from breaking the layout
by entering broken HTML for todo notes.

Closes #765
This commit is contained in:
Eric Allen 2010-04-07 10:06:46 -04:00
parent fdba48c769
commit 68701adaca
3 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
config/environment.rb
View file

@ -23,6 +23,7 @@ Rails::Initializer.run do |config|
config.gem "RedCloth"
config.gem "soap4r", :lib => false
config.gem 'datanoise-actionwebservice', :lib => 'actionwebservice'
config.gem 'sanitize'
config.action_controller.use_accept_header = true