github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-24 02:20:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

XSS fix for category descriptions

Browse Source
This commit is contained in:
Robin Ward 2013-04-01 12:01:27 -04:00
parent 4c5ab8d688
commit e4d190d856
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
app/assets/javascripts/discourse/components/utilities.js
View File

@ -39,19 +39,18 @@ Discourse.Utilities = {
// Create a badge like category link
categoryLink: function(category) {
var color, textColor, name, description, result;
if (!category) return "";
color = Em.get(category, 'color');
textColor = Em.get(category, 'text_color');
name = Em.get(category, 'name');
description = Em.get(category, 'description');
var color = Em.get(category, 'color');
var textColor = Em.get(category, 'text_color');
var name = Em.get(category, 'name');
var description = Em.get(category, 'description');
// Build the HTML link
result = "<a href=\"" + Discourse.getURL("/category/") + this.categoryUrlId(category) + "\" class=\"badge-category\" ";
var result = "<a href=\"" + Discourse.getURL("/category/") + this.categoryUrlId(category) + "\" class=\"badge-category\" ";
// Add description if we have it
if (description) result += "title=\"" + description + "\" ";
if (description) result += "title=\"" + Handlebars.Utils.escapeExpression(description) + "\" ";
return result + "style=\"background-color: #" + color + "; color: #" + textColor + ";\">" + name + "</a>";
},