Skip to content

O
OHR Support
Commit 151b4cd4 authored by Eric Davis's avatar Eric Davis
Browse files
Options

[#163] Add extra escape in mail_to's javascript. Rails CVE-2011-0446

parent 2b6a9828
Hide whitespace changes
Inline Side-by-side
Showing with 1 addition and 1 deletion
app/views/users/show.rhtml
View file @ 151b4cd4
...@@ -7,7 +7,7 @@ ...@@ -7,7 +7,7 @@
<div class="splitcontentleft"> <div class="splitcontentleft">
<ul> <ul>
<% unless @user.pref.hide_mail %> <% unless @user.pref.hide_mail %>
<li><%=l(:field_mail)%>: <%= mail_to(h(@user.mail), nil, :encode => 'javascript') %></li> <li><%=l(:field_mail)%>: <%= mail_to(h(escape_javascript(@user.mail)), nil, :encode => 'javascript') %></li>
<% end %> <% end %>
<% @user.visible_custom_field_values.each do |custom_value| %> <% @user.visible_custom_field_values.each do |custom_value| %>
<% if !custom_value.value.blank? %> <% if !custom_value.value.blank? %>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment