diff options
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/request_controller.rb | 3 | ||||
| -rw-r--r-- | app/controllers/track_controller.rb | 2 | ||||
| -rw-r--r-- | app/controllers/user_controller.rb | 4 | ||||
| -rw-r--r-- | app/views/general/blog.html.erb | 4 |
4 files changed, 8 insertions, 5 deletions
diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb index 413b74cea..39e7616ed 100644 --- a/app/controllers/request_controller.rb +++ b/app/controllers/request_controller.rb @@ -776,6 +776,9 @@ class RequestController < ApplicationController # Prevent spam to magic request address. Note that the binary # subsitution method used depends on the content type @incoming_message.apply_masks!(@attachment.body, @attachment.content_type) + if response.content_type == 'text/html' + @attachment.body = ActionController::Base.helpers.sanitize(@attachment.body) + end render :text => @attachment.body end diff --git a/app/controllers/track_controller.rb b/app/controllers/track_controller.rb index 7018af03c..4b272797f 100644 --- a/app/controllers/track_controller.rb +++ b/app/controllers/track_controller.rb @@ -211,7 +211,7 @@ class TrackController < ApplicationController track_thing.destroy end - redirect_to params[:r] + redirect_to URI.parse(params[:r]).path end diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index b7c8252f5..56f42891d 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -256,7 +256,7 @@ class UserController < ApplicationController def signout clear_session_credentials if params[:r] - redirect_to params[:r] + redirect_to URI.parse(params[:r]).path else redirect_to :controller => "general", :action => "frontpage" end @@ -596,7 +596,7 @@ class UserController < ApplicationController end @user.receive_email_alerts = params[:receive_email_alerts] @user.save! - redirect_to params[:came_from] + redirect_to URI.parse(params[:came_from]).path end private diff --git a/app/views/general/blog.html.erb b/app/views/general/blog.html.erb index 5dda7ab74..fd87bd9fe 100644 --- a/app/views/general/blog.html.erb +++ b/app/views/general/blog.html.erb @@ -10,9 +10,9 @@ <p class="subtitle"><%= _("Posted on {{date}} by {{author}}", :date=>simple_date(Time.parse(item['pubDate'][0])), :author=> item['creator'] ? item['creator'][0] : item['author'][0]) %></p> <div> <% if item['encoded'] %> - <%= raw item['encoded'][0] %> + <%= sanitize(raw item['encoded'][0]) %> <% elsif item['description'] %> - <%= raw item['description'][0] %> + <%= sanitize(raw item['description'][0]) %> <% end %> </div> <p><em> |