Vote #77245
完了Text in the "removed" part of a wiki diff is double-escaped
0%
説明
In a wiki diff (and from the looks of the code the diffs of issue description) html special characters in the deleted parts are double-escaped.
journals
The attached diff adds a test and a diff for this behaviour.
The problem is in source:/trunk/lib/redmine/helpers/diff.rb@15153: the string @deleted@ is concatenated from unsafe strings (lines 46 and 55) and an html escaped string (line 56) and thus html unsafe. It then is added @+@ to an @html_safe@ string in line 65, which causes @deleted@ to be html escaped a second time before being concatenated to the string on the left hand of the @+@.
The patch moves the explicit html escape to line 65 and keeps the explicit html escape to avoid problems with the implicit html escaping performed by the addition @+@ to a @html_safe@ string.
--------------------------------------------------------------------------------
Felix Schäfer wrote:
> The patch moves the explicit html escape to line 65 and keeps the explicit html escape to avoid problems with the implicit html escaping performed by the addition @+@ to a @html_safe@ string.
Ah, and the @.join(' ').html_safe@ at the end is replaced with the safer @safe_join@ which ensures any non-@html_safe@ string in the array is html escaped before concatenation.
--------------------------------------------------------------------------------
@safe_join@ comes from an @ActionView::Helper@ that wasn't included yet in @Redmine::Helpers::Diff@, this patch corrects this omission.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Committed, thanks.
--------------------------------------------------------------------------------