mirror of
https://0xacab.org/sutty/sutty
synced 2024-11-14 17:51:41 +00:00
no permitir html en description ni title
This commit is contained in:
parent
09346110b0
commit
cc94a76567
5 changed files with 36 additions and 3 deletions
12
app/lib/core_extensions/string/strip_tags.rb
Normal file
12
app/lib/core_extensions/string/strip_tags.rb
Normal file
|
@ -0,0 +1,12 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
module CoreExtensions
|
||||
module String
|
||||
# Elimina el HTML
|
||||
module StripTags
|
||||
def strip_tags
|
||||
ActionController::Base.helpers.strip_tags(self)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
|
@ -41,6 +41,15 @@ class Site < ApplicationRecord
|
|||
|
||||
accepts_nested_attributes_for :deploys, allow_destroy: true
|
||||
|
||||
# No permitir HTML en estos atributos
|
||||
def title=(title)
|
||||
super(title.strip_tags)
|
||||
end
|
||||
|
||||
def description=(description)
|
||||
super(description.strip_tags)
|
||||
end
|
||||
|
||||
# El repositorio git para este sitio
|
||||
def repository
|
||||
@repository ||= Site::Repository.new path
|
||||
|
|
3
config/initializers/core_extensions.rb
Normal file
3
config/initializers/core_extensions.rb
Normal file
|
@ -0,0 +1,3 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
String.include CoreExtensions::String::StripTags
|
|
@ -218,7 +218,7 @@ tengamos tiempo de hacerlo realmente.
|
|||
|
||||
* ver las estadisticas de compilación en lugar del log (el log también)
|
||||
* comitear en git los articulos (igual no es de esta rama...)
|
||||
* sanitizar titulo y descripcion, tambien escapar
|
||||
* al crear el sitio incorporar politica de privacidad y codigo de
|
||||
convivencia
|
||||
* link a visitar sitio
|
||||
* editor de opciones
|
||||
* forkear gemas
|
||||
* que les usuaries elijan su propio idioma
|
||||
|
|
|
@ -76,4 +76,13 @@ class SiteTest < ActiveSupport::TestCase
|
|||
assert File.directory?(@site.path)
|
||||
assert_not File.directory?(path)
|
||||
end
|
||||
|
||||
test 'no se puede guardar html en title y description' do
|
||||
site = build :site
|
||||
site.description = "<a href='hola'>hola</a><script>alert('pwned')</script>"
|
||||
site.title = "<a href='hola'>hola</a><script>alert('pwned')</script>"
|
||||
|
||||
assert_equal 'hola', site.description
|
||||
assert_equal 'hola', site.title
|
||||
end
|
||||
end
|
||||
|
|
Loading…
Reference in a new issue