diff --git a/app/models/topic.rb b/app/models/topic.rb index dbd772febc1..1794402bc63 100644 --- a/app/models/topic.rb +++ b/app/models/topic.rb @@ -71,9 +71,6 @@ class Topic < ActiveRecord::Base before_validation do - if SiteSetting.title_sanitize - self.title = sanitize(title.to_s, tags: [], attributes: []).strip.presence - end self.title = TextCleaner.clean_title(TextSentinel.title_sentinel(title).text) if errors[:title].empty? end @@ -250,17 +247,13 @@ class Topic < ActiveRecord::Base end def fancy_title - sanitized_title = if SiteSetting.title_sanitize - sanitize(title.to_s, tags: [], attributes: []).strip.presence - else - title.gsub(/['&\"<>]/, { + sanitized_title = title.gsub(/['&\"<>]/, { "'" => ''', '&' => '&', '"' => '"', '<' => '<', '>' => '>', }) - end return unless sanitized_title return sanitized_title unless SiteSetting.title_fancy_entities? diff --git a/config/locales/server.de.yml b/config/locales/server.de.yml index ed4c221edd9..eae1e45dc9a 100644 --- a/config/locales/server.de.yml +++ b/config/locales/server.de.yml @@ -734,7 +734,6 @@ de: authorized_extensions: "Eine durch Verkettungszeichen (|) verbundene Liste von Dateiendungen, die zum Hochladen gültig sind ('*' um alle Dateiendungen zu erlauben)" max_similar_results: "Anzahl ähnlicher Themen, die ein Nutzer sieht, während er ein neues Thema erstellen." title_prettify: "Verhindert gängige Fehler im Titel, wie reine Grossschreibung, Kleinbuchstaben am Anfang, mehrere ! und ?, überflüssiger . am Ende, etc." - title_sanitize: "Entferne HTML Tags vom Titel" topic_views_heat_low: "Die Anzahl der Aufrufe bis die Popularität des Themas niedrig ist." topic_views_heat_medium: "Die Anzahl der Aufrufe bis die Popularität des Themas mittel ist." topic_views_heat_high: "Die Anzahl der Aufrufe bis die Popularität des Themas hoch ist." diff --git a/config/locales/server.en.yml b/config/locales/server.en.yml index 9a7514271b3..1a1e3d84e4a 100644 --- a/config/locales/server.en.yml +++ b/config/locales/server.en.yml @@ -874,7 +874,6 @@ en: max_similar_results: "How many similar topics to show above the editor when composing a new topic. Comparison is based on title and body." title_prettify: "Prevent common title typos and errors, including all caps, lowercase first character, multiple ! and ?, extra . at end, etc." - title_sanitize: "Remove html tags from the title." topic_views_heat_low: "After this many views, the topic is slightly highlighted." topic_views_heat_medium: "After this many views, the topic is moderately highlighted." diff --git a/config/locales/server.es.yml b/config/locales/server.es.yml index fba83e387b4..68f9cd4888c 100644 --- a/config/locales/server.es.yml +++ b/config/locales/server.es.yml @@ -736,7 +736,6 @@ es: authorized_extensions: "Una lista de extensiones de archivo permitidas, separadas por barras (|) ('*' para permitir todos los tipos de archivo)" max_similar_results: "Cuántos temas similares se muestran al usuario mientras está escribiendo un nuevo tema" title_prettify: "Prevenir errores comunes en el título, incluyendo \"todo mayúsculas\", primera letra minúscula, multiples signos ! o ?, . extra al final, etc." - title_sanitize: "Eliminar etiquetas html del título" topic_views_heat_low: "El número de visitas a partir de las cuales el tema es popular, a nivel bajo." topic_views_heat_medium: "El número de visitas a partir de las cuales el tema es popular, a nivel medio." topic_views_heat_high: "El número de visitas a partir de las cuales el tema es popular, a nivel alto." diff --git a/config/locales/server.fr.yml b/config/locales/server.fr.yml index 22580c9c858..7dc6b5fa281 100644 --- a/config/locales/server.fr.yml +++ b/config/locales/server.fr.yml @@ -720,7 +720,6 @@ fr: authorized_extensions: "Une liste de pipes (|) des extensions de fichier autorisées pour les envois sur le serveur ('*' pour autoriser tout les types)" max_similar_results: "Nombre de sujets similaires à afficher lorsqu'un utilisateur est en train de créer un nouveau sujet" title_prettify: "Corrige les coquilles les plus communes dans les titres (intégralité du titre en majuscule, première lettre en minuscule, de multiples ! et ?, un . inutile à la fin, etc.)" - title_sanitize: "Supprimer les éléments html des titres" topic_views_heat_low: "Le nombre de vues à partir duquel le niveau d'intensité du sujet est : faible." topic_views_heat_medium: "Le nombre de vues à partir duquel le niveau d'intensité du sujet est : moyen." topic_views_heat_high: "Le nombre de vues à partir duquel le niveau d'intensité du sujet est : élevé." diff --git a/config/locales/server.it.yml b/config/locales/server.it.yml index 28a501ab9da..86ca7955f54 100644 --- a/config/locales/server.it.yml +++ b/config/locales/server.it.yml @@ -710,7 +710,6 @@ it: authorized_extensions: "Una lista (separata) di estensioni permesse per l'upload ('*' per permettere tutti i tipi di files)" max_similar_results: "Numero di topic simili da mostrare all'utente durante la creazione di un nuovo topic" title_prettify: "Previeni refusi ed errori comuni nei titoli, inclusi Tutto maiuscolo, Primo carattere minuscolo, ! e ? ripetuti, . aggiuntivi alla fine, etc etc." - title_sanitize: "Rimuovi tag html dal titolo" topic_views_heat_low: "Il numero di visite affinché il livello di heat di un topic è basso." topic_views_heat_medium: "Il numero di visite affinché il livello di heat di un topic è medio." topic_views_heat_high: "Il numero di visite affinché il livello di heat di un topic è alto." diff --git a/config/locales/server.nl.yml b/config/locales/server.nl.yml index 582cea1c11f..a7e7df1c237 100644 --- a/config/locales/server.nl.yml +++ b/config/locales/server.nl.yml @@ -711,7 +711,6 @@ nl: max_attachment_size_kb: "De maximale bestandsgrootte die we toestaan voor uploads, in kB. Zorg er voor dat deze limiet ook ingesteld is in nginx (client_max_body_size) / apache of een proxy." max_similar_results: "How many similar topics to show a user while they are composing a new topic" title_prettify: "Voorkom veel voorkomende fouten in titels (alles in hoofdletters, eerste woord zonder hoofdletter, meerdere ! en ?, een extra . aan het eind, etc." - title_sanitize: "Verwijder html-tags uit de titel" topic_views_heat_low: "Het aantal keer dat een topic bekeken moet zijn om een laag 'heat' level te hebben." topic_views_heat_medium: "Het aantal keer dat een topic bekeken moet zijn om een medium 'heat' level te hebben." topic_views_heat_high: "Het aantal keer dat een topic bekeken moet zijn om een hoog 'heat' level te hebben." diff --git a/config/locales/server.pt_BR.yml b/config/locales/server.pt_BR.yml index 2b811be8c5c..51878789c22 100644 --- a/config/locales/server.pt_BR.yml +++ b/config/locales/server.pt_BR.yml @@ -712,7 +712,6 @@ pt_BR: authorized_extensions: "Uma lista separada por barras verticais (|) das extensões de arquivo permitidas para envio (use '*' para permitir todos os tipos de arquivo)" max_similar_results: "Quantos tópicos similares devem ser exibidos para um usuário enquanto ele está redigindo um novo tópico" title_prettify: "Prevenir erros comuns em títulos, incluindo caps-lock ligado, primeira letra minúscula, excesso de ! e ?, pontos extras no final, etc." - title_sanitize: "Remover tags html do título" topic_views_heat_low: "Número de visualizações a partir da qual o nível de calor de um tópico se torna baixo." topic_views_heat_medium: "Número de visualizações a partir da qual o nível de calor de um tópico se torna médio." topic_views_heat_high: "Número de visualizações a partir da qual o nível de calor de um tópico se torna alto." diff --git a/config/locales/server.zh_CN.yml b/config/locales/server.zh_CN.yml index 75284c76be8..dd46a29c8ab 100644 --- a/config/locales/server.zh_CN.yml +++ b/config/locales/server.zh_CN.yml @@ -703,7 +703,6 @@ zh_CN: authorized_extensions: "用'|'分割的允许上传文件的扩展名列表（'*' 表示允许所有文件类型）" max_similar_results: "当用户撰写新主题时，显示多少类似主题给用户" title_prettify: "防止常见标题里的错别字和错误，包括全部大写，第一个字符小写，多个'！'和'？'，结尾多余的'.'等等。" - title_sanitize: "从标题中移除 HTML 标签" topic_views_heat_low: "多少浏览量后主题的热度变为低。" topic_views_heat_medium: "多少浏览量后主题的热度变为中。" topic_views_heat_high: "多少浏览量后主题的热度变为高。" diff --git a/config/locales/server.zh_TW.yml b/config/locales/server.zh_TW.yml index 2b53f796422..a81b7691f39 100644 --- a/config/locales/server.zh_TW.yml +++ b/config/locales/server.zh_TW.yml @@ -561,7 +561,6 @@ zh_TW: max_image_size_kb: "允許用戶上傳的最大檔大小(以kB為單位) - 確保在nginx(client_max_body_size), apache或代理服務中進行限制檔大小的配置." max_similar_results: "當使用者撰寫新討論話題時，顯示多少類似討論話題給使用者" title_prettify: "防止常見標題裡的錯別字和錯誤，包括全部大寫，首字小寫，多個！和？，結尾多餘的. 等等。" - title_sanitize: "從標題移除 HTML 標籤" topic_views_heat_low: "多少流覽量後討論話題的熱度變為低。" topic_views_heat_medium: "多少流覽量後討論話題的熱度變為中。" topic_views_heat_high: "多少流覽量後討論話題的熱度變為高。" diff --git a/config/site_settings.yml b/config/site_settings.yml index 8d26b43eb6f..93275554540 100644 --- a/config/site_settings.yml +++ b/config/site_settings.yml @@ -292,7 +292,6 @@ posting: default: 255 title_min_entropy: 10 title_prettify: true - title_sanitize: false title_fancy_entities: true min_private_message_title_length: client: true diff --git a/spec/models/topic_spec.rb b/spec/models/topic_spec.rb index 273a553ba02..fb41d569351 100644 --- a/spec/models/topic_spec.rb +++ b/spec/models/topic_spec.rb @@ -120,40 +120,16 @@ describe Topic do let(:topic_image) { build_topic_with_title("Topic with image in its title" ) } let(:topic_script) { build_topic_with_title("Topic with script in its title" ) } - context "title_sanitize disabled" do - - before { SiteSetting.stubs(:title_sanitize).returns(false) } - - it "escapes script contents" do - topic_script.fancy_title.should == "Topic with <script>alert(‘title’)</script> script in its title" - end - - it "escapes bold contents" do - topic_bold.fancy_title.should == "Topic with <b>bold</b> text in its title" - end - - it "escapes image contents" do - topic_image.fancy_title.should == "Topic with <img src=‘something’> image in its title" - end - + it "escapes script contents" do + topic_script.fancy_title.should == "Topic with <script>alert(‘title’)</script> script in its title" end - context "title_sanitize enabled" do - - before { SiteSetting.stubs(:title_sanitize).returns(true) } - - it "removes script contents" do - topic_script.fancy_title.should == "Topic with script in its title" - end - - it "removes bold contents" do - topic_bold.fancy_title.should == "Topic with bold text in its title" - end - - it "removes image contents" do - topic_image.fancy_title.should == "Topic with image in its title" - end + it "escapes bold contents" do + topic_bold.fancy_title.should == "Topic with <b>bold</b> text in its title" + end + it "escapes image contents" do + topic_image.fancy_title.should == "Topic with <img src=‘something’> image in its title" end end