jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix xss vuln

Browse Source
This commit is contained in:
Albert Yi
2018-05-22 14:47:00 -07:00
parent 4b790e163e
commit 0e7349ca48
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/assets/javascripts/related_tag.js.erb
View File

@@ -236,7 +236,7 @@
if (desc.length > 30) { if (desc.length > 30) {
desc = desc.substring(0, 30) + "..."; desc = desc.substring(0, 30) + "...";
} }
var $del = $("<del/>").html(desc); var $del = $("<del/>").text(desc);
$ul.append($("<li/>").html($del)); $ul.append($("<li/>").html($del));
} else if (text.match(/^ http/)) { } else if (text.match(/^ http/)) {
text = text.substring(1, 1000); text = text.substring(1, 1000);

2
app/views/artists/_form.html.erb
View File

@@ -16,7 +16,7 @@
</div> </div>
<%= f.input :other_names_comma, :hint => "Separate with commas", :as => :text, :label => "Other names" %> <%= f.input :other_names_comma, :hint => "Separate with commas", :as => :text, :label => "Other names" %>
<%= f.input :group_name %> <%= f.input :group_name %>
<%= f.input :url_string, :label => "URLs", :as => :text, :input_html => {:size => "50x5", :value => params.dig(:artist, :url_string) || @artist.url_array.join("\n")} %> <%= f.input :url_string, :label => "URLs", :as => :text, :input_html => {:size => "50x5", :value => params.dig(:artist, :url_string) || @artist.urls.join("\n")} %>
<%= dtext_field "artist", "notes" %> <%= dtext_field "artist", "notes" %>
<%= f.button :submit, "Submit" %> <%= f.button :submit, "Submit" %>