diff options
author | Felipe Artur Cardozo <fcardozo@gitlab.com> | 2018-07-27 00:16:34 +0300 |
---|---|---|
committer | Felipe Artur Cardozo <fcardozo@gitlab.com> | 2018-07-27 00:16:34 +0300 |
commit | 45c94aba1b90dbe86c5583c8782cc3f624249fa1 (patch) | |
tree | 94c1f356586495318cad13a4ef04ad52a7835e3c /app | |
parent | 9852304befb88cd112cb681ff5cca0c31cd2ddd4 (diff) | |
parent | dfe0981deceddb9c927fa503aed77d1a97040d60 (diff) |
Merge branch '48617-promoting-milestone' into 'master'
[master] Escapes milestone title shown in flash message when promoting a milestone
See merge request gitlab/gitlabhq!2436
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/projects/labels_controller.rb | 11 | ||||
-rw-r--r-- | app/controllers/projects/milestones_controller.rb | 11 |
2 files changed, 20 insertions, 2 deletions
diff --git a/app/controllers/projects/labels_controller.rb b/app/controllers/projects/labels_controller.rb index 21d3c918581..ce03b2d8d1d 100644 --- a/app/controllers/projects/labels_controller.rb +++ b/app/controllers/projects/labels_controller.rb @@ -112,7 +112,7 @@ class Projects::LabelsController < Projects::ApplicationController begin return render_404 unless promote_service.execute(@label) - flash[:notice] = "#{@label.title} promoted to <a href=\"#{group_labels_path(@project.group)}\">group label</a>.".html_safe + flash[:notice] = flash_notice_for(@label, @project.group) respond_to do |format| format.html do redirect_to(project_labels_path(@project), status: :see_other) @@ -135,6 +135,15 @@ class Projects::LabelsController < Projects::ApplicationController end end + def flash_notice_for(label, group) + notice = ''.html_safe + notice << label.title + notice << ' promoted to ' + notice << view_context.link_to('<u>group label</u>'.html_safe, group_labels_path(group)) + notice << '.' + notice + end + protected def label_params diff --git a/app/controllers/projects/milestones_controller.rb b/app/controllers/projects/milestones_controller.rb index 5e86ec93f34..b9b3dcd5a85 100644 --- a/app/controllers/projects/milestones_controller.rb +++ b/app/controllers/projects/milestones_controller.rb @@ -76,8 +76,8 @@ class Projects::MilestonesController < Projects::ApplicationController def promote promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone) + flash[:notice] = flash_notice_for(promoted_milestone, project.group) - flash[:notice] = "#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe respond_to do |format| format.html do redirect_to project_milestones_path(project) @@ -90,6 +90,15 @@ class Projects::MilestonesController < Projects::ApplicationController redirect_to milestone, alert: error.message end + def flash_notice_for(milestone, group) + notice = ''.html_safe + notice << milestone.title + notice << ' promoted to ' + notice << view_context.link_to('<u>group milestone</u>'.html_safe, group_milestone_path(group, milestone.iid)) + notice << '.' + notice + end + def destroy return access_denied! unless can?(current_user, :admin_milestone, @project) |