Commit 1959f0d9 authored by Jonne Haß's avatar Jonne Haß
Browse files

Merge branch 'hotfix/0.4.1.1' into develop

Conflicts:
	Changelog.md
	config/defaults.yml
parents 648a45b4 a5ca738e
......@@ -60,6 +60,10 @@ The default for including jQuery from a CDN has changed. If you want to continue
* Increase possible captcha length [#5169](https://github.com/diaspora/diaspora/pull/5169)
* Display visibility icon in publisher aspects dropdown [#4982](https://github.com/diaspora/diaspora/pull/4982)
# 0.4.1.1
* Fix XSS issue in poll questions [#5274](https://github.com/diaspora/diaspora/issues/5274)
# 0.4.1.0
## New 'Terms of Service' feature and template
......
{{#if poll}}
<div class="poll_form">
<div class="row-fluid poll_head">
<strong>{{{poll.question}}}</strong>
<strong>{{poll.question}}</strong>
<div class="poll_statistic pull-right">
{{t "poll.count" count=poll.participation_count}}
</div>
......
......@@ -35,6 +35,15 @@ describe("app.views.Poll", function(){
})
});
describe("render", function() {
it("escapes the poll question", function() {
var question = "<script>alert(0);</script>";
this.view.poll.question = question;
this.view.render();
expect(this.view.$('.poll_head strong').text()).toBe(question);
});
});
describe("vote form", function(){
it('show vote form when user is logged in and not voted before', function(){
expect(this.view.$('form').length).toBe(1);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment