rooty/fab-manager
1
0
Fork 0
mirror of https://github.com/LaCasemate/fab-manager.git synced 2024-11-29 10:24:20 +01:00
Code Issues Releases Activity

fix xss vulnerability in projects

Browse Source
This commit is contained in:
Nicolas Florentin 2022-07-27 10:28:58 +02:00
parent eb83dbf798
commit e4fb068c12
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/views/api/projects/show.json.jbuilder
View File

@ -1,6 +1,7 @@
# frozen_string_literal: true # frozen_string_literal: true
json.extract! @project, :id, :name, :description, :tags, :created_at, :updated_at, :licence_id, :slug json.extract! @project, :id, :name, :tags, :created_at, :updated_at, :licence_id, :slug
json.description sanitize(@project.description)
json.author_id @project.author.user_id json.author_id @project.author.user_id
json.project_image @project.project_image.attachment.large.url if @project.project_image json.project_image @project.project_image.attachment.large.url if @project.project_image
json.project_full_image @project.project_image.attachment.url if @project.project_image json.project_full_image @project.project_image.attachment.url if @project.project_image
@ -56,7 +57,7 @@ json.project_users @project.project_users do |pu|
end end
json.project_steps_attributes @project.project_steps.order('project_steps.step_nb ASC') do |s| json.project_steps_attributes @project.project_steps.order('project_steps.step_nb ASC') do |s|
json.id s.id json.id s.id
json.description s.description json.description sanitize(s.description)
json.title s.title json.title s.title
json.project_step_images_attributes s.project_step_images.order('created_at ASC') do |si| json.project_step_images_attributes s.project_step_images.order('created_at ASC') do |si|
json.id si.id json.id si.id

2
config/application.rb
View File

@ -74,6 +74,8 @@ module Fablab
FabManager.activate_plugins! FabManager.activate_plugins!
config.action_view.sanitized_allowed_tags = %w(a acronym hr pre table b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p image iframe)
config.after_initialize do config.after_initialize do
plugins = FabManager.plugins plugins = FabManager.plugins
plugins&.each(&:notify_after_initialize) plugins&.each(&:notify_after_initialize)