XSS Security Fix

There was a XSS vulnerability in the handling of categories. Now they are escaped.
2007-09-02 00:33:28 -05:00 · 2007-09-02 00:33:28 -05:00 · 5ff1b7f6da
commit 5ff1b7f6da
parent 6fd6be8fea
2 changed files with 8 additions and 1 deletions
--- a/lib/chunks/chunk.rb
+++ b/lib/chunks/chunk.rb
@ -74,6 +74,13 @@ module Chunk
      @content.delete_chunk(self)
    end

+    def  html_escape(string)
+      string.gsub( /&/, "&amp;" ).
+             gsub( /</, "&lt;" ).
+             gsub( />/, "&gt;" ).
+             gsub( /"/, "&quot;" )
+    end
+
  end

 end