Sanitize the contents of HTML attachments before display0.13.0.6hotfix/0.13.0.6

2 files changed, 7 insertions, 0 deletions

diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb
index 45d8b7de6..f9b41f989 100644
--- a/app/controllers/request_controller.rb
+++ b/app/controllers/request_controller.rb
@@ -736,6 +736,10 @@ class RequestController < ApplicationController
         # we don't use @attachment.content_type here, as we want same mime type when cached in cache_attachments above
         response.content_type = AlaveteliFileTypes.filename_to_mimetype(params[:file_name]) || 'application/octet-stream'
 
+        if response.content_type == 'text/html'
+            @attachment.body = ActionController::Base.helpers.sanitize(@attachment.body)
+        end
+
         render :text => @attachment.body
     end
 
diff --git a/config/application.rb b/config/application.rb
index 92fd30685..005d81225 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -35,6 +35,9 @@ module Alaveteli
     # JavaScript files you want as :defaults (application.js is always included).
     # config.action_view.javascript_expansions[:defaults] = %w(jquery rails)
 
+    # Allow some extra tags to be whitelisted in the 'sanitize' helper method
+    config.action_view.sanitized_allowed_tags = 'html', 'head', 'body', 'table', 'tr', 'td', 'style'
+
     # Configure the default encoding used in templates for Ruby 1.9.
     config.encoding = "utf-8"