diff options
| author | Bob Van Landuyt <bob@gitlab.com> | 2018-10-05 20:47:52 +0300 |
|---|---|---|
| committer | Bob Van Landuyt <bob@gitlab.com> | 2018-10-05 20:47:52 +0300 |
| commit | 36bd07838263f709b0ca9af4830ee75cde7e8f97 (patch) | |
| tree | b64f4170048b6299b45e8b50900584ac58af5984 /app | |
| parent | d26bf613b45066b3d2c78ef539cffc109cc39064 (diff) | |
| parent | 829c9c65f9b730b3ecad7d3ba222e3dcd6489b85 (diff) | |
Merge branch 'security-bw-confidential-titles-through-markdown-api' into 'master'
[master] Confidential issue/private snippet titles can be read by unauthenticated user through GFM markdown API
Closes #2706
See merge request gitlab/gitlabhq!2507
Diffstat (limited to 'app')
| -rw-r--r-- | app/models/project_services/hipchat_service.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/models/project_services/hipchat_service.rb b/app/models/project_services/hipchat_service.rb index 66012f0da99..a69b7b4c4b6 100644 --- a/app/models/project_services/hipchat_service.rb +++ b/app/models/project_services/hipchat_service.rb @@ -149,7 +149,7 @@ class HipchatService < Service context.merge!(options) - html = Banzai.post_process(Banzai.render(text, context), context) + html = Banzai.render_and_post_process(text, context) sanitized_html = sanitize(html, tags: HIPCHAT_ALLOWED_TAGS, attributes: %w[href title alt]) sanitized_html.truncate(200, separator: ' ', omission: '...') |