Merge pull request #2274 from evazion/xss/pool-gallery

Fix XSS in pool names in /pools/gallery page.
2014-10-17 14:33:48 -07:00
parent 6d68f1357e 22c624c356
commit 4249f528f9
1 changed files with 1 additions and 1 deletions
--- a/app/presenters/post_presenter.rb
+++ b/app/presenters/post_presenter.rb
@@ -27,7 +27,7 @@ class PostPresenter < Presenter
    if options[:pool]
      html << %{<p class="desc">}
      html << %{<a href="/pools/#{options[:pool].id}">}
-      html << options[:pool].pretty_name.truncate(80)
+      html << h(options[:pool].pretty_name.truncate(80))
      html << %{</a>}
      html << %{</p>}
    end