Commit 82b13a21 authored by Makoto Scott-Hinkle's avatar Makoto Scott-Hinkle Committed by Makoto Scott-Hinkle

Allowing ">" to be used for Milestone models's title and storing the value in db as unescaped.

Updating test value for milestone title

Adding API test for title with reserved HTML characters.

Updating changelog

Adding the MR number for fixing bug #22452.

removing duplicate line

Updating MR number.
parent 80fef70b
...@@ -20,6 +20,7 @@ v 8.13.0 (unreleased) ...@@ -20,6 +20,7 @@ v 8.13.0 (unreleased)
- Optimize GitHub importing for speed and memory - Optimize GitHub importing for speed and memory
- API: expose pipeline data in builds API (!6502, Guilherme Salazar) - API: expose pipeline data in builds API (!6502, Guilherme Salazar)
- Fix broken repository 500 errors in project list - Fix broken repository 500 errors in project list
- Fix unnecessary escaping of reserved HTML characters in milestone title. !6533
v 8.12.4 (unreleased) v 8.12.4 (unreleased)
......
...@@ -158,7 +158,7 @@ class Milestone < ActiveRecord::Base ...@@ -158,7 +158,7 @@ class Milestone < ActiveRecord::Base
end end
def title=(value) def title=(value)
write_attribute(:title, Sanitize.clean(value.to_s)) if value.present? write_attribute(:title, sanitize_title(value)) if value.present?
end end
# Sorts the issues for the given IDs. # Sorts the issues for the given IDs.
...@@ -204,4 +204,8 @@ class Milestone < ActiveRecord::Base ...@@ -204,4 +204,8 @@ class Milestone < ActiveRecord::Base
iid iid
end end
end end
def sanitize_title(value)
CGI.unescape_html(Sanitize.clean(value.to_s))
end
end end
...@@ -20,10 +20,10 @@ describe Milestone, models: true do ...@@ -20,10 +20,10 @@ describe Milestone, models: true do
let(:user) { create(:user) } let(:user) { create(:user) }
describe "#title" do describe "#title" do
let(:milestone) { create(:milestone, title: "<b>test</b>") } let(:milestone) { create(:milestone, title: "<b>foo & bar -> 2.2</b>") }
it "sanitizes title" do it "sanitizes title" do
expect(milestone.title).to eq("test") expect(milestone.title).to eq("foo & bar -> 2.2")
end end
end end
......
...@@ -104,6 +104,14 @@ describe API::API, api: true do ...@@ -104,6 +104,14 @@ describe API::API, api: true do
expect(response).to have_http_status(400) expect(response).to have_http_status(400)
end end
it 'creates a new project with reserved html characters' do
post api("/projects/#{project.id}/milestones", user), title: 'foo & bar 1.1 -> 2.2'
expect(response).to have_http_status(201)
expect(json_response['title']).to eq('foo & bar 1.1 -> 2.2')
expect(json_response['description']).to be_nil
end
end end
describe 'PUT /projects/:id/milestones/:milestone_id' do describe 'PUT /projects/:id/milestones/:milestone_id' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment