Sanitize user attrs on model level

1 files changed, 10 insertions, 0 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 6de8d2d4c39..ddbdec8acfc 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -116,7 +116,10 @@ class User < ActiveRecord::Base
   validate :namespace_uniq, if: ->(user) { user.username_changed? }
 
   before_validation :generate_password, on: :create
+  before_validation :sanitize_attrs
+
   before_save :ensure_authentication_token
+
   alias_attribute :private_token, :authentication_token
 
   delegate :path, to: :namespace, allow_nil: true, prefix: true
@@ -371,4 +374,11 @@ class User < ActiveRecord::Base
   def created_by
     User.find_by_id(created_by_id) if created_by_id
   end
+
+  def sanitize_attrs
+    %w(name username skype linkedin twitter bio).each do |attr|
+      value = self.send(attr)
+      self.send("#{attr}=", Sanitize.clean(value)) if value.present?
+    end
+  end
 end