Change 227
Change 227 by nullbyte@nullbyte-gentoo on 2005/10/30 23:50:17
strip <script> out of page bodies. someone (zz9) had an XSS in FrontPage within
3 hours of me mentioning the myspace worm at the pub.
Affected files ...| //depot/projects/wiki/app/models/page.rb#2 |  edit | text |
==== //depot/projects/wiki/app/models/page.rb#2 (text) ====
| @@ -10,6 +10,8 @@ | ||
| 10 | 10 | |
| 11 | 11 | def to_html |
| 12 | 12 | html = RedCloth.new(body.to_s).to_html |
| 13 | html.gsub!(/<\/?script[^>]*>/i, '') | |
| 14 | html.gsub!(/\son\w+\s*=/i, ' x-nope=') | |
| 13 | 15 | html.gsub(WIKI_WORD) { "<a href=\"/wiki/show/#{$1}\">#{$1}</a>" } |
| 14 | 16 | end |
| 15 | 17 | end |