Nulo/gitea
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Activity

Escape the commit message on issues update and title in telegram hook (#6901)

Browse source
This commit is contained in:
zeripath 2019-05-10 18:48:28 +01:00 committed by techknowlogick
parent 10ff527fae
commit d64a646c0a
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
models/action.go
View file

@ -8,6 +8,7 @@ package models
import ( import (
"encoding/json" "encoding/json"
"fmt" "fmt"
"html"
"path" "path"
"regexp" "regexp"
"strconv" "strconv"
@ -580,7 +581,7 @@ func UpdateIssuesCommit(doer *User, repo *Repository, commits []*PushCommit, bra
} }
refMarked[issue.ID] = true refMarked[issue.ID] = true
message := fmt.Sprintf(`<a href="%s/commit/%s">%s</a>`, repo.Link(), c.Sha1, c.Message) message := fmt.Sprintf(`<a href="%s/commit/%s">%s</a>`, repo.Link(), c.Sha1, html.EscapeString(c.Message))
if err = CreateRefComment(doer, refRepo, issue, message, c.Sha1); err != nil { if err = CreateRefComment(doer, refRepo, issue, message, c.Sha1); err != nil {
return err return err
} }

3
models/webhook_telegram.go
View file

@ -7,6 +7,7 @@ package models
import ( import (
"encoding/json" "encoding/json"
"fmt" "fmt"
"html"
"strings" "strings"
"code.gitea.io/gitea/modules/git" "code.gitea.io/gitea/modules/git"
@ -169,7 +170,7 @@ func getTelegramIssuesPayload(p *api.IssuePayload) (*TelegramPayload, error) {
func getTelegramIssueCommentPayload(p *api.IssueCommentPayload) (*TelegramPayload, error) { func getTelegramIssueCommentPayload(p *api.IssueCommentPayload) (*TelegramPayload, error) {
url := fmt.Sprintf("%s/issues/%d#%s", p.Repository.HTMLURL, p.Issue.Index, CommentHashTag(p.Comment.ID)) url := fmt.Sprintf("%s/issues/%d#%s", p.Repository.HTMLURL, p.Issue.Index, CommentHashTag(p.Comment.ID))
title := fmt.Sprintf(`<a href="%s">#%d %s</a>`, url, p.Issue.Index, p.Issue.Title) title := fmt.Sprintf(`<a href="%s">#%d %s</a>`, url, p.Issue.Index, html.EscapeString(p.Issue.Title))
var text string var text string
switch p.Action { switch p.Action {
case api.HookIssueCommentCreated: case api.HookIssueCommentCreated: