diff options
author | Clement Ho <clemmakesapps@gmail.com> | 2018-04-18 18:28:02 +0300 |
---|---|---|
committer | Clement Ho <clemmakesapps@gmail.com> | 2018-04-18 18:28:02 +0300 |
commit | cad4eb989e87c2e1ce996cfb5817d2c1729111c8 (patch) | |
tree | c22d766e5f9dd8a299a3d68cd70f8a04df7e754a /app/helpers | |
parent | 02579d6aeba3673c950896bdb511df8c678e20ca (diff) | |
parent | d8dd75ca775f66fd756e43ddd73ac75d39fc3e64 (diff) |
Merge branch 'master' into 'bootstrap4'
# Conflicts:
# app/views/projects/issues/_nav_btns.html.haml
# app/views/projects/merge_requests/creations/_new_compare.html.haml
Diffstat (limited to 'app/helpers')
-rw-r--r-- | app/helpers/blob_helper.rb | 2 | ||||
-rw-r--r-- | app/helpers/diff_helper.rb | 2 | ||||
-rw-r--r-- | app/helpers/safe_params_helper.rb | 11 |
3 files changed, 13 insertions, 2 deletions
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb index 866b8773db6..fef29789832 100644 --- a/app/helpers/blob_helper.rb +++ b/app/helpers/blob_helper.rb @@ -259,7 +259,7 @@ module BlobHelper options = [] if error == :collapsed - options << link_to('load it anyway', url_for(params.merge(viewer: viewer.type, expanded: true, format: nil))) + options << link_to('load it anyway', url_for(safe_params.merge(viewer: viewer.type, expanded: true, format: nil))) end # If the error is `:server_side_but_stored_externally`, the simple viewer will show the same error, diff --git a/app/helpers/diff_helper.rb b/app/helpers/diff_helper.rb index b5ca39711bc..1bb82fd8150 100644 --- a/app/helpers/diff_helper.rb +++ b/app/helpers/diff_helper.rb @@ -180,7 +180,7 @@ module DiffHelper private def diff_btn(title, name, selected) - params_copy = params.dup + params_copy = safe_params.dup params_copy[:view] = name # Always use HTML to handle case where JSON diff rendered this button diff --git a/app/helpers/safe_params_helper.rb b/app/helpers/safe_params_helper.rb new file mode 100644 index 00000000000..b568e8810cc --- /dev/null +++ b/app/helpers/safe_params_helper.rb @@ -0,0 +1,11 @@ +module SafeParamsHelper + # Rails 5.0 requires to permit `params` if they're used in url helpers. + # Use this helper when generating links with `params.merge(...)` + def safe_params + if params.respond_to?(:permit!) + params.except(:host, :port, :protocol).permit! + else + params + end + end +end |