diff options
| author | Louise Crow <louise.crow@gmail.com> | 2014-12-22 10:55:30 +0000 |
|---|---|---|
| committer | Louise Crow <louise.crow@gmail.com> | 2014-12-22 16:58:50 +0000 |
| commit | 62f386d698f2e90490fddc7ecca19d7cfc08480a (patch) | |
| tree | fa30a9ef1c2a20d24097f63faad14d1b489493f0 | |
| parent | c011d3dc05059985c370731d9291a747ceffaa76 (diff) | |
Sanitize the contents of HTML attachments before display
| -rw-r--r-- | app/controllers/request_controller.rb | 4 | ||||
| -rw-r--r-- | config/application.rb | 3 |
2 files changed, 7 insertions, 0 deletions
diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb index 388473b51..e28ed3a46 100644 --- a/app/controllers/request_controller.rb +++ b/app/controllers/request_controller.rb @@ -733,6 +733,10 @@ class RequestController < ApplicationController # we don't use @attachment.content_type here, as we want same mime type when cached in cache_attachments above response.content_type = AlaveteliFileTypes.filename_to_mimetype(params[:file_name]) || 'application/octet-stream' + if response.content_type == 'text/html' + @attachment.body = ActionController::Base.helpers.sanitize(@attachment.body) + end + render :text => @attachment.body end diff --git a/config/application.rb b/config/application.rb index 4c972e5ee..87eb0df2d 100644 --- a/config/application.rb +++ b/config/application.rb @@ -37,6 +37,9 @@ module Alaveteli # JavaScript files you want as :defaults (application.js is always included). # config.action_view.javascript_expansions[:defaults] = %w(jquery rails) + # Allow some extra tags to be whitelisted in the 'sanitize' helper method + config.action_view.sanitized_allowed_tags = 'html', 'head', 'body', 'table', 'tr', 'td', 'style' + # Configure the default encoding used in templates for Ruby 1.9. config.encoding = "utf-8" |