diff options
| author | francis <francis> | 2007-12-17 19:35:13 +0000 |
|---|---|---|
| committer | francis <francis> | 2007-12-17 19:35:13 +0000 |
| commit | 1fe0610ff3f77d4222dae203f988f1b5d19bff32 (patch) | |
| tree | 23b7f04ca2d3dee725aee6bee22909d74132b0f1 | |
| parent | 2ea894e43dd43fd2b81bc2bc1092c626c5dc04c7 (diff) | |
Don't display email addresses in bodies.
| -rw-r--r-- | app/models/incoming_message.rb | 15 | ||||
| -rw-r--r-- | app/views/request/_correspondence.rhtml | 2 |
2 files changed, 15 insertions, 2 deletions
diff --git a/app/models/incoming_message.rb b/app/models/incoming_message.rb index 31b6eca35..f1ae68410 100644 --- a/app/models/incoming_message.rb +++ b/app/models/incoming_message.rb @@ -19,7 +19,7 @@ # Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved. # Email: francis@mysociety.org; WWW: http://www.mysociety.org/ # -# $Id: incoming_message.rb,v 1.6 2007-12-11 12:16:29 francis Exp $ +# $Id: incoming_message.rb,v 1.7 2007-12-17 19:35:13 francis Exp $ class IncomingMessage < ActiveRecord::Base belongs_to :info_request @@ -44,6 +44,19 @@ class IncomingMessage < ActiveRecord::Base # Use date it arrived (created_at) if mail itself doesn't have Date: header self.mail.date || self.created_at end + + # Use this when displaying the body text + def sanitised_body + body = self.mail.body.dup + + # Remove any email addresses - we don't want bounce messages to leak out + # either the requestor's email address or the request's response email + # address out onto the internet + rx = Regexp.new(MySociety::Validate.email_match_regexp) + body.gsub!(rx, "...@...") + + return body + end end diff --git a/app/views/request/_correspondence.rhtml b/app/views/request/_correspondence.rhtml index 5695c87ff..7a85bb627 100644 --- a/app/views/request/_correspondence.rhtml +++ b/app/views/request/_correspondence.rhtml @@ -21,7 +21,7 @@ </p> <% elsif (correspondence.class.to_s == 'IncomingMessage') incoming_message = correspondence%> - <%= render :partial => 'bubble', :locals => { :body => incoming_message.mail.body } %> + <%= render :partial => 'bubble', :locals => { :body => incoming_message.sanitised_body } %> <p class="xspeaker"> <%= incoming_message.mail.friendly_from %> |