From c36132551b62e7d249948712d6dc47be614c28a5 Mon Sep 17 00:00:00 2001 From: hukl Date: Sat, 17 Oct 2009 13:56:01 +0200 Subject: added sanitize statements to hopefully all critical templates to protect against cross site scripting. added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list --- app/helpers/content_helper.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'app/helpers') diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb index 2eb0c4d2..9eb7d7e7 100644 --- a/app/helpers/content_helper.rb +++ b/app/helpers/content_helper.rb @@ -85,13 +85,13 @@ module ContentHelper options[:partial] = select_partial( options[:partial] ) - content.sub(tag, render_collection(options)) + sanitize( content.sub(tag, render_collection(options)) ) else - content + sanitize( content ) end rescue - content + sanatize( content ) end end -- cgit v1.3