diff options
author | Douwe Maan <douwe@gitlab.com> | 2015-12-24 23:19:03 +0300 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2015-12-24 23:19:03 +0300 |
commit | 32543f3bd94b1b66dd949b0fb1f57bff3732eb45 (patch) | |
tree | 0d7a6f0d19cc07f70dd4e5ab657034a529ddb741 /lib/banzai | |
parent | 0ca74f7aad0d5b63955c86397fffdd9e670c56f3 (diff) |
More escaping!
Diffstat (limited to 'lib/banzai')
-rw-r--r-- | lib/banzai/filter/abstract_reference_filter.rb | 8 | ||||
-rw-r--r-- | lib/banzai/filter/reference_filter.rb | 2 |
2 files changed, 5 insertions, 5 deletions
diff --git a/lib/banzai/filter/abstract_reference_filter.rb b/lib/banzai/filter/abstract_reference_filter.rb index 36d8c12e2b3..b99ccd98624 100644 --- a/lib/banzai/filter/abstract_reference_filter.rb +++ b/lib/banzai/filter/abstract_reference_filter.rb @@ -102,7 +102,7 @@ module Banzai project = project_from_ref(project_ref) if project && object = find_object(project, id) - title = escape_once(object_link_title(object)) + title = object_link_title(object) klass = reference_class(object_sym) data = data_attribute( @@ -114,11 +114,11 @@ module Banzai url = matches[:url] if matches.names.include?("url") url ||= url_for_object(object, project) - text = link_text || escape_once(object_link_text(object, matches)) + text = link_text || object_link_text(object, matches) %(<a href="#{url}" #{data} - title="#{title}" - class="#{klass}">#{text}</a>) + title="#{escape_once(title)}" + class="#{klass}">#{escape_once(text)}</a>) else match end diff --git a/lib/banzai/filter/reference_filter.rb b/lib/banzai/filter/reference_filter.rb index c183702516a..a22a7a7afd3 100644 --- a/lib/banzai/filter/reference_filter.rb +++ b/lib/banzai/filter/reference_filter.rb @@ -44,7 +44,7 @@ module Banzai # Returns a String def data_attribute(attributes = {}) attributes[:reference_filter] = self.class.name.demodulize - attributes.map { |key, value| %Q(data-#{key.to_s.dasherize}="#{value}") }.join(" ") + attributes.map { |key, value| %Q(data-#{key.to_s.dasherize}="#{escape_once(value)}") }.join(" ") end def escape_once(html) |