Defect #30758

Preview URL in Wiki Toolbar should be escaped

Added by Vincent Robert 8 months ago. Updated 8 months ago.

Status:ClosedStart date:
Priority:NormalDue date:
Assignee:Go MAEDA% Done:

0%

Category:Wiki
Target version:4.0.2
Resolution:Fixed Affected version:4.0.1

Description

Since Redmine 4.0.0 and the addition of the preview tab, the wiki toolbar is not displayed if the preview url contains single quotes. The url is not escaped and we can see an error in our browser console.
We should escape the preview url:

diff --git a/lib/redmine/wiki_formatting/markdown/helper.rb b/lib/redmine/wiki_formatting/markdown/helper.rb
index fac2f8bf3..fb9f1a939 100644
--- a/lib/redmine/wiki_formatting/markdown/helper.rb
+++ b/lib/redmine/wiki_formatting/markdown/helper.rb
@@ -22,7 +22,7 @@ module Redmine
         def wikitoolbar_for(field_id, preview_url = preview_text_path)
           heads_for_wiki_formatter
           url = "#{Redmine::Utils.relative_url_root}/help/#{current_language.to_s.downcase}/wiki_syntax_markdown.html" 
-          javascript_tag("var wikiToolbar = new jsToolBar(document.getElementById('#{field_id}')); wikiToolbar.setHelpLink('#{escape_javascript url}'); wikiToolbar.setPreviewUrl('#{preview_url}'); wikiToolbar.draw();")
+          javascript_tag("var wikiToolbar = new jsToolBar(document.getElementById('#{field_id}')); wikiToolbar.setHelpLink('#{escape_javascript url}'); wikiToolbar.setPreviewUrl('#{escape_javascript preview_url}'); wikiToolbar.draw();")
         end

         def initial_page_content(page)
diff --git a/lib/redmine/wiki_formatting/textile/helper.rb b/lib/redmine/wiki_formatting/textile/helper.rb
index 6e8ba9812..e536a29dc 100644
--- a/lib/redmine/wiki_formatting/textile/helper.rb
+++ b/lib/redmine/wiki_formatting/textile/helper.rb
@@ -23,7 +23,7 @@ module Redmine
           heads_for_wiki_formatter
           # Is there a simple way to link to a public resource?
           url = "#{Redmine::Utils.relative_url_root}/help/#{current_language.to_s.downcase}/wiki_syntax_textile.html" 
-          javascript_tag("var wikiToolbar = new jsToolBar(document.getElementById('#{field_id}')); wikiToolbar.setHelpLink('#{escape_javascript url}'); wikiToolbar.setPreviewUrl('#{preview_url}'); wikiToolbar.draw();")
+          javascript_tag("var wikiToolbar = new jsToolBar(document.getElementById('#{field_id}')); wikiToolbar.setHelpLink('#{escape_javascript url}'); wikiToolbar.setPreviewUrl('#{escape_javascript preview_url}'); wikiToolbar.draw();")
         end

         def initial_page_content(page)

escape_preview_url.diff Magnifier (1.99 KB) Vincent Robert, 2019-02-06 19:10

screenshot.png (207 KB) Vincent Robert, 2019-02-07 08:18


Related issues

Related to Redmine - Feature #27758: Adds preview option to the wiki toolbar Closed

Associated revisions

Revision 17856
Added by Go MAEDA 8 months ago

Preview URL in Wiki Toolbar should be escaped (#30758).

Patch by Vincent Robert.

Revision 17857
Added by Go MAEDA 8 months ago

Merged r17856 from trunk to 4.0-stable (#30758).

History

#1 Updated by Go MAEDA 8 months ago

  • Status changed from New to Needs feedback

Thank you for the patch. Could you paste some example URLs that reproduce the problem?

#2 Updated by Vincent Robert 8 months ago

Here is an example. The last link will lead to a form where the wikitoolbar is missing.

h1. CookBook documentation

{{child_pages}}

Some updated [[documentation]] here with gzipped history

{{toc}}

* [[Installation]]

* [[Rock'n Roll]]

#3 Updated by Go MAEDA 8 months ago

Vincent Robert wrote:

Here is an example. The last link will lead to a form where the wikitoolbar is missing.

[...]

Thank you. But it does not break the toolbar in my environment. Could you paste a screenshot that shows the problem? Sorry for bothering you again and again.

#4 Updated by Vincent Robert 8 months ago

Here it is:

#5 Updated by Go MAEDA 8 months ago

  • Status changed from Needs feedback to Confirmed

#6 Updated by Go MAEDA 8 months ago

  • Target version set to 4.0.2

Setting the target version to 4.0.2.

#7 Updated by Go MAEDA 8 months ago

  • Status changed from Confirmed to Closed
  • Assignee set to Go MAEDA
  • Resolution set to Fixed

Committed the patch. Thank you for detecting and fixing this issue.

#8 Updated by Vincent Robert 8 months ago

Thanks.

How could we associate this kind of patch with our Github account?
I think more contributors would be motivated if they could get credit in Github.

#9 Updated by Marius BALTEANU 8 months ago

Thanks Vincent for reporting and fixing this issue.

Vincent Robert wrote:

How could we associate this kind of patch with our Github account?
I think more contributors would be motivated if they could get credit in Github.

I don't think that it is possible mostly because of the SVN.

#10 Updated by Marius BALTEANU 7 months ago

  • Related to Feature #27758: Adds preview option to the wiki toolbar added

Also available in: Atom PDF