scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-12-11 22:56:41 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #379 from okriuchykhin/ok_SCI_632

Browse source 
Fix XSS vulnerability in protocol keywords [SCI-632]
This commit is contained in:
okriuchykhin 2016-12-30 15:28:05 +01:00 • committed by GitHub
commit 36f07b908a
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/protocols_controller.rb
View file

@ -159,6 +159,10 @@ class ProtocolsController < ApplicationController
def update_keywords
respond_to do |format|
# sanitize user input
params[:keywords].collect! do |keyword|
ActionController::Base.helpers.sanitize(keyword)
end
if @protocol.update_keywords(params[:keywords])
format.json {
render json: {

4
app/views/protocols/header/_keywords_label.html.erb
View file

@ -1,5 +1,5 @@
<% if @protocol.protocol_keywords.count > 0 %>
<%= @protocol.protocol_keywords.collect{ |kw| "<strong>#{kw.name}</strong>" }.join(", ").html_safe %>
<%= @protocol.protocol_keywords.collect{ |kw| "<strong>#{sanitize(kw.name)}</strong>" }.join(", ").html_safe %>
<% else %>
<em><%= t("protocols.no_keywords") %></em>
<% end %>
<% end %>