osr-plastic/osr-discourse-src
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

SECURITY: topic titles can show up in user page unescaped when streamed in

Browse Source
This commit is contained in:
Sam Saffron 2016-02-01 20:53:26 +11:00
parent 9e22fa91e8
commit 51da6676f0
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/assets/javascripts/discourse/models/user.js.es6
View File

@ -177,7 +177,9 @@ const User = RestModel.extend({
if ((this.get('stream.filter') || ua.action_type) !== ua.action_type) return;
if (!this.get('stream.filter') && !this.inAllStream(ua)) return;
const action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(ua)]);
ua.title = Discourse.Emoji.unescape(Handlebars.Utils.escapeExpression(ua.title));
const action = UserAction.collapseStream([UserAction.create(ua)]);
stream.set('itemsLoaded', stream.get('itemsLoaded') + 1);
stream.get('content').insertAt(0, action[0]);
}