Defect #22115
closed
Text in the "removed" part of a wiki diff is double-escaped
Added by Felix Schäfer about 8 years ago.
Updated about 8 years ago.
Description
In a wiki diff (and from the looks of the code the diffs of issue description) html special characters in the deleted parts are double-escaped.
Files
The attached diff adds a test and a diff for this behaviour.
The problem is in source:/trunk/lib/redmine/helpers/diff.rb@15153: the string deleted is concatenated from unsafe strings (lines 46 and 55) and an html escaped string (line 56) and thus html unsafe. It then is added + to an html_safe string in line 65, which causes deleted to be html escaped a second time before being concatenated to the string on the left hand of the +.
The patch moves the explicit html escape to line 65 and keeps the explicit html escape to avoid problems with the implicit html escaping performed by the addition + to a html_safe string.
Felix Schäfer wrote:
The patch moves the explicit html escape to line 65 and keeps the explicit html escape to avoid problems with the implicit html escaping performed by the addition + to a html_safe string.
Ah, and the .join(' ').html_safe at the end is replaced with the safer safe_join which ensures any non-html_safe string in the array is html escaped before concatenation.
safe_join comes from an ActionView::Helper that wasn't included yet in Redmine::Helpers::Diff, this patch corrects this omission.
- Target version set to 3.3.0
- Subject changed from Text in the "removed" part of a diff is double-escaped to Text in the "removed" part of a wiki diff is double-escaped
- Status changed from New to Closed
- Assignee set to Jean-Philippe Lang
- Resolution set to Fixed
Also available in: Atom
PDF
Updated by 
Updated by Toshi MARUYAMA 
Updated by