diff options
| author | Raphael Sofaer <raphael@joindiaspora.com> | 2011-07-08 09:13:02 +0400 |
|---|---|---|
| committer | Raphael Sofaer <raphael@joindiaspora.com> | 2011-07-08 09:13:02 +0400 |
| commit | d8e891b492ffe1896e925b7dc3ea7acf1bee9f7f (patch) | |
| tree | bcfafbceddb814992aa0b963bd7a8026a871c5fd /lib | |
| parent | 8af95909c2c1320a13ea930674d4bbf3bb3f7a3f (diff) | |
Revert "escape js in format_tags until I can think about whether we have an XSS problem in the morning"
This reverts commit 8af95909c2c1320a13ea930674d4bbf3bb3f7a3f.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/diaspora/taggable.rb | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/lib/diaspora/taggable.rb b/lib/diaspora/taggable.rb index 99fbf1b8a..7c3ab66bd 100644 --- a/lib/diaspora/taggable.rb +++ b/lib/diaspora/taggable.rb @@ -4,7 +4,6 @@ module Diaspora module Taggable - extend ActionView::Helpers::JavaScriptHelper VALID_TAG_BODY = /[^_,\s#*\[\]()\@\/"'\.%]+\b/ def self.included(model) @@ -40,7 +39,7 @@ module Diaspora def self.format_tags(text, opts={}) return text if opts[:plain_text] regex = /(^|\s)#(#{VALID_TAG_BODY})/ - form_message = escape_javascript(text).gsub(regex) do |matched_string| + form_message = text.gsub(regex) do |matched_string| "#{$~[1]}<a href=\"/tags/#{$~[2]}\" class=\"tag\">##{$~[2]}</a>" end form_message.html_safe |