Project

General

Profile

Actions

Defect #22115

closed

Text in the "removed" part of a wiki diff is double-escaped

Added by Felix Schäfer over 8 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Category:
UI
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:

Description

In a wiki diff (and from the looks of the code the diffs of issue description) html special characters in the deleted parts are double-escaped.


Files

Actions #1

Updated by Felix Schäfer over 8 years ago

The attached diff adds a test and a diff for this behaviour.

The problem is in source:/trunk/lib/redmine/helpers/diff.rb@15153: the string deleted is concatenated from unsafe strings (lines 46 and 55) and an html escaped string (line 56) and thus html unsafe. It then is added + to an html_safe string in line 65, which causes deleted to be html escaped a second time before being concatenated to the string on the left hand of the +.

The patch moves the explicit html escape to line 65 and keeps the explicit html escape to avoid problems with the implicit html escaping performed by the addition + to a html_safe string.

Actions #2

Updated by Felix Schäfer over 8 years ago

Felix Schäfer wrote:

The patch moves the explicit html escape to line 65 and keeps the explicit html escape to avoid problems with the implicit html escaping performed by the addition + to a html_safe string.

Ah, and the .join(' ').html_safe at the end is replaced with the safer safe_join which ensures any non-html_safe string in the array is html escaped before concatenation.

Actions #3

Updated by Felix Schäfer over 8 years ago

safe_join comes from an ActionView::Helper that wasn't included yet in Redmine::Helpers::Diff, this patch corrects this omission.

Actions #4

Updated by Toshi MARUYAMA over 8 years ago

  • Target version set to 3.3.0
Actions #5

Updated by Jean-Philippe Lang over 8 years ago

  • Subject changed from Text in the "removed" part of a diff is double-escaped to Text in the "removed" part of a wiki diff is double-escaped
  • Status changed from New to Closed
  • Assignee set to Jean-Philippe Lang
  • Resolution set to Fixed

Committed, thanks.

Actions

Also available in: Atom PDF