Commit a5ca738e authored by Jonne Haß's avatar Jonne Haß
Browse files

Fix XSS issue in poll questions

closes #5274
parent dcb0d8dd
# 0.4.1.1
* Fix XSS issue in poll questions [#5274](https://github.com/diaspora/diaspora/issues/5274)
# 0.4.1.0
## New 'Terms of Service' feature and template
......
{{#if poll}}
<div class="poll_form">
<div class="row-fluid poll_head">
<strong>{{{poll.question}}}</strong>
<strong>{{poll.question}}</strong>
<div class="poll_statistic pull-right">
{{t "poll.count" count=poll.participation_count}}
</div>
......@@ -12,13 +12,13 @@
{{#poll.poll_answers}}
<label class="radio result-row">
<input type="radio" name="vote" value="{{id}}"/>
{{answer}}
{{answer}}
<span class="percentage pull-right" style="display: none;"></span>
<div class="poll_progress_bar_wrapper progress" style="display: none">
<div class="poll_progress_bar bar" data-answerid="{{id}}">
</div>
</div>
</label>
</label>
{{/poll.poll_answers}}
<div class="toggle_result_wrapper">
<a class="toggle_result" href="#">{{t "poll.show_result"}}</a>
......
......@@ -4,7 +4,7 @@
defaults:
version:
number: "0.4.1.0" # Do not touch unless doing a release, do not backport the version number that's in master but keep develop to always say "head"
number: "0.4.1.1" # Do not touch unless doing a release, do not backport the version number that's in master but keep develop to always say "head"
heroku: false
environment:
url: "http://localhost:3000/"
......
......@@ -35,6 +35,15 @@ describe("app.views.Poll", function(){
})
});
describe("render", function() {
it("escapes the poll question", function() {
var question = "<script>alert(0);</script>";
this.view.poll.question = question;
this.view.render();
expect(this.view.$('.poll_head strong').text()).toBe(question);
});
});
describe("vote form", function(){
it('show vote form when user is logged in and not voted before', function(){
expect(this.view.$('form').length).toBe(1);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment