diff options
| author | Robert Speicher <robert@gitlab.com> | 2017-05-02 21:32:14 +0000 |
|---|---|---|
| committer | Lin Jen-Shin <godfat@godfat.org> | 2017-05-04 20:09:14 +0800 |
| commit | 33949560b12d45b050ee9ec1d29c0fd0228cf02e (patch) | |
| tree | 88a0981f97905c25c4a41d34e7b892b787993aaf /app | |
| parent | 509e05052312aaec3d32086aada3fae322381d96 (diff) | |
| download | gitlab-ce-33949560b12d45b050ee9ec1d29c0fd0228cf02e.tar.gz | |
Merge branch 'fix-hamlit-xss' into 'security-9-1'
New Hamlit XSS fix, does not include extraneous changes
See merge request !2095
Diffstat (limited to 'app')
| -rw-r--r-- | app/views/import/base/create.js.haml | 2 | ||||
| -rw-r--r-- | app/views/projects/imports/new.html.haml | 2 | ||||
| -rw-r--r-- | app/views/projects/wikis/git_access.html.haml | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/app/views/import/base/create.js.haml b/app/views/import/base/create.js.haml index 8e929538351..57e8c3ca1e1 100644 --- a/app/views/import/base/create.js.haml +++ b/app/views/import/base/create.js.haml @@ -10,4 +10,4 @@ - else :plain job = $("tr#repo_#{@repo_id}") - job.find(".import-actions").html("<i class='fa fa-exclamation-circle'></i> Error saving project: #{escape_javascript(@project.errors.full_messages.join(','))}") + job.find(".import-actions").html("<i class='fa fa-exclamation-circle'></i> Error saving project: #{escape_javascript(h(@project.errors.full_messages.join(',')))}") diff --git a/app/views/projects/imports/new.html.haml b/app/views/projects/imports/new.html.haml index 2cd8d03e30e..25a87411cac 100644 --- a/app/views/projects/imports/new.html.haml +++ b/app/views/projects/imports/new.html.haml @@ -10,7 +10,7 @@ .panel-body %pre :preserve - #{sanitize_repo_path(@project, @project.import_error)} + #{h(sanitize_repo_path(@project, @project.import_error))} = form_for @project, url: namespace_project_import_path(@project.namespace, @project), method: :post, html: { class: 'form-horizontal' } do |f| = render "shared/import_form", f: f diff --git a/app/views/projects/wikis/git_access.html.haml b/app/views/projects/wikis/git_access.html.haml index fb0efd85dcd..68862206248 100644 --- a/app/views/projects/wikis/git_access.html.haml +++ b/app/views/projects/wikis/git_access.html.haml @@ -28,7 +28,7 @@ %h3 Clone your wiki %pre.dark :preserve - git clone #{ content_tag(:span, default_url_to_repo(@project_wiki), class: 'clone')} + git clone #{ content_tag(:span, h(default_url_to_repo(@project_wiki)), class: 'clone')} cd #{h @project_wiki.path} %h3 Start Gollum and edit locally |