Redmine

While creating this patch #44660 the following was discovered:

app/views/users/edit.html.erb puts the avatar into the page title by inserting it after the last space in the HTML returned by title:

page_title.insert(page_title.rindex(' ') + 1, avatar(@user).to_s)

This works today because the title ends with » login</h2> and a login has no spaces. But the search is not limited to the heading: if anything follows the <h2> in the returned HTML (for example a plugin that appends to the title through a helper override), the last space can be inside that markup, and the avatar is inserted there, which produces invalid HTML.

The attached patch limits the search to the heading, so the avatar is always placed before the login inside the <h2>:

page_title.insert(page_title.rindex(' ', page_title.index('</h2>')) + 1, avatar(@user).to_s)

The output is unchanged for core as it is. Against trunk.