diff options
| author | Alessio Caiazza <acaiazza@gitlab.com> | 2018-07-23 14:58:18 +0000 |
|---|---|---|
| committer | Felipe Artur <felipefac@gmail.com> | 2018-07-24 17:01:58 -0300 |
| commit | 41d61cbabbdfcd7621216eb9ae47306c9e3fccc7 (patch) | |
| tree | 20b4c71b5cec33a6902ae2c0722725aba3af2e82 /app | |
| parent | ae8a7797367a5e9e97f8b3e6e7d2f25c31bb7064 (diff) | |
| download | gitlab-ce-41d61cbabbdfcd7621216eb9ae47306c9e3fccc7.tar.gz | |
Merge branch 'security-11-1-48617-promoting-milestone' into 'security-11-1'
[11.1] Escapes milestone title shown in flash message when promoting a milestone
See merge request gitlab/gitlabhq!2443
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/projects/labels_controller.rb | 11 | ||||
| -rw-r--r-- | app/controllers/projects/milestones_controller.rb | 11 |
2 files changed, 20 insertions, 2 deletions
diff --git a/app/controllers/projects/labels_controller.rb b/app/controllers/projects/labels_controller.rb index 91016f6494e..83216c99561 100644 --- a/app/controllers/projects/labels_controller.rb +++ b/app/controllers/projects/labels_controller.rb @@ -112,7 +112,7 @@ class Projects::LabelsController < Projects::ApplicationController begin return render_404 unless promote_service.execute(@label) - flash[:notice] = "#{@label.title} promoted to <a href=\"#{group_labels_path(@project.group)}\">group label</a>.".html_safe + flash[:notice] = flash_notice_for(@label, @project.group) respond_to do |format| format.html do redirect_to(project_labels_path(@project), status: 303) @@ -135,6 +135,15 @@ class Projects::LabelsController < Projects::ApplicationController end end + def flash_notice_for(label, group) + notice = ''.html_safe + notice << label.title + notice << ' promoted to ' + notice << view_context.link_to('<u>group label</u>'.html_safe, group_labels_path(group)) + notice << '.' + notice + end + protected def label_params diff --git a/app/controllers/projects/milestones_controller.rb b/app/controllers/projects/milestones_controller.rb index 594563d1f6f..1d389c26654 100644 --- a/app/controllers/projects/milestones_controller.rb +++ b/app/controllers/projects/milestones_controller.rb @@ -76,8 +76,8 @@ class Projects::MilestonesController < Projects::ApplicationController def promote promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone) + flash[:notice] = flash_notice_for(promoted_milestone, project.group) - flash[:notice] = "#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe respond_to do |format| format.html do redirect_to project_milestones_path(project) @@ -90,6 +90,15 @@ class Projects::MilestonesController < Projects::ApplicationController redirect_to milestone, alert: error.message end + def flash_notice_for(milestone, group) + notice = ''.html_safe + notice << milestone.title + notice << ' promoted to ' + notice << view_context.link_to('<u>group milestone</u>'.html_safe, group_milestone_path(group, milestone.iid)) + notice << '.' + notice + end + def destroy return access_denied! unless can?(current_user, :admin_milestone, @project) |