scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-10-31 00:19:20 +08:00
Code Issues Projects Releases Packages Wiki Activity

Improve escaping of special characters in flash messages [SCI-8137] (#5144)

Browse source
This commit is contained in:
Alex Kriuchykhin 2023-03-15 15:56:47 +01:00 • committed by GitHub
parent 44823da268
commit b0251435e5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/access_permissions/projects_controller.rb
View file

@ -69,7 +69,7 @@ module AccessPermissions
respond_to do |format|
if project_member.destroy
format.json do
render json: { flash: t('access_permissions.destroy.success', member_name: user.full_name) },
render json: { flash: t('access_permissions.destroy.success', member_name: escape_input(user.full_name)) },
status: :ok
end
else

2
app/controllers/assets_controller.rb
View file

@ -235,7 +235,7 @@ class AssetsController < ApplicationController
log_result_activity(:edit_result, @assoc)
end
render json: { flash: I18n.t('assets.file_deleted', file_name: @asset.file_name) }
render json: { flash: I18n.t('assets.file_deleted', file_name: escape_input(@asset.file_name)) }
else
render json: {}, status: :unprocessable_entity
end

4
app/controllers/repository_rows_controller.rb
View file

@ -260,7 +260,7 @@ class RepositoryRowsController < ApplicationController
team: current_team)
if service.succeed?
render json: { flash: t('repositories.archive_records.success_flash', repository: @repository.name) }, status: :ok
render json: { flash: t('repositories.archive_records.success_flash', repository: escape_input(@repository.name)) }
else
render json: { error: service.error_message }, status: :unprocessable_entity
end
@ -273,7 +273,7 @@ class RepositoryRowsController < ApplicationController
team: current_team)
if service.succeed?
render json: { flash: t('repositories.restore_records.success_flash', repository: @repository.name) }, status: :ok
render json: { flash: t('repositories.restore_records.success_flash', repository: escape_input(@repository.name)) }
else
render json: { error: service.error_message }, status: :unprocessable_entity
end