diff options
author | Robert Speicher <robert@gitlab.com> | 2016-05-09 02:53:49 +0300 |
---|---|---|
committer | Robert Speicher <robert@gitlab.com> | 2016-05-09 02:53:49 +0300 |
commit | 4bc4f06512620271a8d454b966e7f5c288a68829 (patch) | |
tree | ebaa412a7a403c17f2af0254a5d2253508cdb398 /app/services | |
parent | 4a47470febe34bf67e84a2904422626caa64224e (diff) | |
parent | adf9a51899b02f7adc678dca7909201500f05026 (diff) |
Merge branch 'escape-commit-titles' into 'master'
Escape HTML in commit titles in system note messages
Closes #17348
See merge request !4084
Diffstat (limited to 'app/services')
-rw-r--r-- | app/services/system_note_service.rb | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/app/services/system_note_service.rb b/app/services/system_note_service.rb index 82a0e2fd1f5..4bdb1b0c074 100644 --- a/app/services/system_note_service.rb +++ b/app/services/system_note_service.rb @@ -351,7 +351,7 @@ class SystemNoteService # Returns an Array of Strings def self.new_commit_summary(new_commits) new_commits.collect do |commit| - "* #{commit.short_id} - #{commit.title}" + "* #{commit.short_id} - #{escape_html(commit.title)}" end end @@ -433,4 +433,8 @@ class SystemNoteService body = "Moved #{direction} #{cross_reference}" create_note(noteable: noteable, project: project, author: author, note: body) end + + def self.escape_html(text) + Rack::Utils.escape_html(text) + end end |