diff options
| author | Filipa Lacerda <filipa@gitlab.com> | 2018-07-16 11:49:01 +0100 |
|---|---|---|
| committer | Filipa Lacerda <filipa@gitlab.com> | 2018-07-17 10:21:12 +0100 |
| commit | a0930b83ecfa0513990fcae8450726add1d9206d (patch) | |
| tree | 8b41e3ef78c4b1d77b855050db7422c188e9d6f6 /app | |
| parent | fc9f90045d930641690f75e9bae25683dc67a24e (diff) | |
| download | gitlab-ce-a0930b83ecfa0513990fcae8450726add1d9206d.tar.gz | |
Escapes milestone and label names when promoting them
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/projects/labels_controller.rb | 11 | ||||
| -rw-r--r-- | app/controllers/projects/milestones_controller.rb | 14 |
2 files changed, 21 insertions, 4 deletions
diff --git a/app/controllers/projects/labels_controller.rb b/app/controllers/projects/labels_controller.rb index 21d3c918581..ce03b2d8d1d 100644 --- a/app/controllers/projects/labels_controller.rb +++ b/app/controllers/projects/labels_controller.rb @@ -112,7 +112,7 @@ class Projects::LabelsController < Projects::ApplicationController begin return render_404 unless promote_service.execute(@label) - flash[:notice] = "#{@label.title} promoted to <a href=\"#{group_labels_path(@project.group)}\">group label</a>.".html_safe + flash[:notice] = flash_notice_for(@label, @project.group) respond_to do |format| format.html do redirect_to(project_labels_path(@project), status: :see_other) @@ -135,6 +135,15 @@ class Projects::LabelsController < Projects::ApplicationController end end + def flash_notice_for(label, group) + notice = ''.html_safe + notice << label.title + notice << ' promoted to ' + notice << view_context.link_to('<u>group label</u>'.html_safe, group_labels_path(group)) + notice << '.' + notice + end + protected def label_params diff --git a/app/controllers/projects/milestones_controller.rb b/app/controllers/projects/milestones_controller.rb index 17571935c1c..b9b3dcd5a85 100644 --- a/app/controllers/projects/milestones_controller.rb +++ b/app/controllers/projects/milestones_controller.rb @@ -1,5 +1,4 @@ class Projects::MilestonesController < Projects::ApplicationController - include ActionView::Helpers::SanitizeHelper include Gitlab::Utils::StrongMemoize include MilestoneActions @@ -77,8 +76,8 @@ class Projects::MilestonesController < Projects::ApplicationController def promote promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone) - milestone_title = sanitize(milestone.title) - flash[:notice] = "#{milestone_title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe + flash[:notice] = flash_notice_for(promoted_milestone, project.group) + respond_to do |format| format.html do redirect_to project_milestones_path(project) @@ -91,6 +90,15 @@ class Projects::MilestonesController < Projects::ApplicationController redirect_to milestone, alert: error.message end + def flash_notice_for(milestone, group) + notice = ''.html_safe + notice << milestone.title + notice << ' promoted to ' + notice << view_context.link_to('<u>group milestone</u>'.html_safe, group_milestone_path(group, milestone.iid)) + notice << '.' + notice + end + def destroy return access_denied! unless can?(current_user, :admin_milestone, @project) |