nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't let user put HTML in alt and title image attribute of avatar

Browse source
This commit is contained in:
Dorian 2010-12-24 15:33:04 +01:00
parent 7796776135
commit 293445225a
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/helpers/application_helper.rb
View file

@ -124,7 +124,7 @@ module ApplicationHelper
end
def person_image_tag(person, size=:thumb_small)
"<img alt='#{person.name}' class='avatar' data-person_id='#{person.id}' src='#{image_or_default(person, size)}' title='#{person.name}'>".html_safe
"<img alt=\"#{h(person.name)}\" class=\"avatar\" data-person_id=\"#{person.id}\" src=\"#{image_or_default(person, size)}\" title=\"#{h(person.name)}\">".html_safe
end
def person_link(person)