From c36132551b62e7d249948712d6dc47be614c28a5 Mon Sep 17 00:00:00 2001
From: hukl <contact@smyck.org>
Date: Sat, 17 Oct 2009 13:56:01 +0200
Subject: added sanitize statements to hopefully all critical templates to
 protect against cross site scripting.

added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list
---
 app/views/nodes/show.html.erb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'app/views/nodes')

diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index 8f56c7cb..99fb264e 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -36,15 +36,15 @@
     </tr>
     <tr>
       <td class="description"><strong>Title</strong></td>
-      <td><%= @page.title %></td>
+      <td><%= sanitize( @page.title ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Abstract</strong></td>
-      <td><%= @page.abstract %></td>
+      <td><%= sanitize( @page.abstract ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Body</strong></td>
-      <td><%= @page.body %></td>
+      <td><%= sanitize( @page.body ) %></td>
     </tr>
     <tr>
       <td></td>
-- 
cgit v1.3