jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix hidden attribute leaks in data attributes (#3237).

Browse Source
This commit is contained in:
evazion
2017-07-24 19:54:01 -05:00
parent 9893dc1734
commit f2bf756422
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/presenters/post_presenter.rb
View File

@@ -66,7 +66,7 @@ class PostPresenter < Presenter
end end
def self.data_attributes(post) def self.data_attributes(post)
%{ attributes = %{
data-id="#{post.id}" data-id="#{post.id}"
data-has-sound="#{post.has_tag?('video_with_sound|flash_with_sound')}" data-has-sound="#{post.has_tag?('video_with_sound|flash_with_sound')}"
data-tags="#{h(post.tag_string)}" data-tags="#{h(post.tag_string)}"
@@ -83,15 +83,22 @@ class PostPresenter < Presenter
data-views="#{post.view_count}" data-views="#{post.view_count}"
data-fav-count="#{post.fav_count}" data-fav-count="#{post.fav_count}"
data-pixiv-id="#{post.pixiv_id}" data-pixiv-id="#{post.pixiv_id}"
data-md5="#{post.md5}"
data-file-ext="#{post.file_ext}" data-file-ext="#{post.file_ext}"
data-file-url="#{post.file_url}"
data-large-file-url="#{post.large_file_url}"
data-preview-file-url="#{post.preview_file_url}"
data-source="#{h(post.source)}" data-source="#{h(post.source)}"
data-normalized-source="#{h(post.normalized_source)}" data-normalized-source="#{h(post.normalized_source)}"
data-is-favorited="#{post.favorited_by?(CurrentUser.user.id)}" data-is-favorited="#{post.favorited_by?(CurrentUser.user.id)}"
}.html_safe }
if post.visible?
attributes += %{
data-md5="#{post.md5}"
data-file-url="#{post.file_url}"
data-large-file-url="#{post.large_file_url}"
data-preview-file-url="#{post.preview_file_url}"
}
end
attributes.html_safe
end end
def initialize(post) def initialize(post)