diff options
| author | Louise Crow <louise.crow@gmail.com> | 2014-12-22 10:55:30 +0000 |
|---|---|---|
| committer | Louise Crow <louise.crow@gmail.com> | 2014-12-22 16:26:17 +0000 |
| commit | 70e466aad42a94d8e2b024e543eaaf7f4eec336a (patch) | |
| tree | 8e30b7e664d1647a78da17fc48e7f16a6bbf4e75 /app/controllers/request_controller.rb | |
| parent | 136cb0743594b91a335686aa7d942b8017392b11 (diff) | |
Sanitize the contents of HTML attachments before display
Diffstat (limited to 'app/controllers/request_controller.rb')
| -rw-r--r-- | app/controllers/request_controller.rb | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb index 3fa0ef0ce..5897bd534 100644 --- a/app/controllers/request_controller.rb +++ b/app/controllers/request_controller.rb @@ -750,6 +750,10 @@ class RequestController < ApplicationController # we don't use @attachment.content_type here, as we want same mime type when cached in cache_attachments above response.content_type = AlaveteliFileTypes.filename_to_mimetype(params[:file_name]) || 'application/octet-stream' + if response.content_type == 'text/html' + @attachment.body = ActionController::Base.helpers.sanitize(@attachment.body) + end + render :text => @attachment.body end |