Sanitize milestones and label titlesissue_15394

2 files changed, 10 insertions, 0 deletions

diff --git a/app/models/label.rb b/app/models/label.rb
index 60bdce32952..0b34911a4e9 100644
--- a/app/models/label.rb
+++ b/app/models/label.rb
@@ -117,6 +117,11 @@ class Label < ActiveRecord::Base
     LabelsHelper::text_color_for_bg(self.color)
   end
 
+  def title= value
+    value = Sanitize.clean(value.to_s) if value
+    write_attribute(:title, Sanitize.clean(value))
+  end
+
   private
 
   def label_format_reference(format = :id)
diff --git a/app/models/milestone.rb b/app/models/milestone.rb
index 986184dd301..ed81791c69c 100644
--- a/app/models/milestone.rb
+++ b/app/models/milestone.rb
@@ -129,6 +129,11 @@ class Milestone < ActiveRecord::Base
     nil
   end
 
+  def title= value
+    value = Sanitize.clean(value.to_s) if value
+    write_attribute(:title, value)
+  end
+
   # Sorts the issues for the given IDs.
   #
   # This method runs a single SQL query using a CASE statement to update the