Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-07 13:55:52 +01:00
Code Issues Packages Projects Releases Activity

Escape flash messages (#19117).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@14016 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2015-02-17 17:47:36 +00:00
parent 177dd7bff1
commit 2a7795ab52
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/account_controller.rb
View File

@@ -293,7 +293,7 @@ class AccountController < ApplicationController
token = Token.new(:user => user, :action => "register") token = Token.new(:user => user, :action => "register")
if user.save and token.save if user.save and token.save
Mailer.register(token).deliver Mailer.register(token).deliver
flash[:notice] = l(:notice_account_register_done, :email => user.mail) flash[:notice] = l(:notice_account_register_done, :email => ERB::Util.h(user.mail))
redirect_to signin_path redirect_to signin_path
else else
yield if block_given? yield if block_given?

6
app/controllers/admin_controller.rb
View File

@@ -51,7 +51,7 @@ class AdminController < ApplicationController
Redmine::DefaultData::Loader::load(params[:lang]) Redmine::DefaultData::Loader::load(params[:lang])
flash[:notice] = l(:notice_default_data_loaded) flash[:notice] = l(:notice_default_data_loaded)
rescue Exception => e rescue Exception => e
flash[:error] = l(:error_can_t_load_default_data, e.message) flash[:error] = l(:error_can_t_load_default_data, ERB::Util.h(e.message))
end end
end end
redirect_to admin_path redirect_to admin_path
@@ -63,9 +63,9 @@ class AdminController < ApplicationController
ActionMailer::Base.raise_delivery_errors = true ActionMailer::Base.raise_delivery_errors = true
begin begin
@test = Mailer.test_email(User.current).deliver @test = Mailer.test_email(User.current).deliver
flash[:notice] = l(:notice_email_sent, User.current.mail) flash[:notice] = l(:notice_email_sent, ERB::Util.h(User.current.mail))
rescue Exception => e rescue Exception => e
flash[:error] = l(:notice_email_error, Redmine::CodesetUtil.replace_invalid_utf8(e.message.dup)) flash[:error] = l(:notice_email_error, ERB::Util.h(Redmine::CodesetUtil.replace_invalid_utf8(e.message.dup)))
end end
ActionMailer::Base.raise_delivery_errors = raise_delivery_errors ActionMailer::Base.raise_delivery_errors = raise_delivery_errors
redirect_to settings_path(:tab => 'notifications') redirect_to settings_path(:tab => 'notifications')