Commit ba37848d authored by Clement Ho's avatar Clement Ho Committed by Robert Speicher

Merge branch 'fix-user-select-dropdown-escaping' into 'security-9-5'

Fixes the User Selection Display (9.5)

See merge request gitlab/gitlabhq!2177
parent 9b09856e
...@@ -75,7 +75,7 @@ function UsersSelect(currentUser, els) { ...@@ -75,7 +75,7 @@ function UsersSelect(currentUser, els) {
if (currentUserInfo) { if (currentUserInfo) {
input.value = currentUserInfo.id; input.value = currentUserInfo.id;
input.dataset.meta = currentUserInfo.name; input.dataset.meta = _.escape(currentUserInfo.name);
} else if (_this.currentUser) { } else if (_this.currentUser) {
input.value = _this.currentUser.id; input.value = _this.currentUser.id;
} }
...@@ -198,7 +198,7 @@ function UsersSelect(currentUser, els) { ...@@ -198,7 +198,7 @@ function UsersSelect(currentUser, els) {
}; };
} }
$value.html(assigneeTemplate(user)); $value.html(assigneeTemplate(user));
$collapsedSidebar.attr('title', user.name).tooltip('fixTitle'); $collapsedSidebar.attr('title', _.escape(user.name)).tooltip('fixTitle');
return $collapsedSidebar.html(collapsedAssigneeTemplate(user)); return $collapsedSidebar.html(collapsedAssigneeTemplate(user));
}); });
}; };
...@@ -506,7 +506,7 @@ function UsersSelect(currentUser, els) { ...@@ -506,7 +506,7 @@ function UsersSelect(currentUser, els) {
img = ""; img = "";
if (user.beforeDivider != null) { if (user.beforeDivider != null) {
`<li><a href='#' class='${selected === true ? 'is-active' : ''}'>${user.name}</a></li>`; `<li><a href='#' class='${selected === true ? 'is-active' : ''}'>${_.escape(user.name)}</a></li>`;
} else { } else {
if (avatar) { if (avatar) {
img = "<img src='" + avatar + "' class='avatar avatar-inline' width='32' />"; img = "<img src='" + avatar + "' class='avatar avatar-inline' width='32' />";
...@@ -518,7 +518,7 @@ function UsersSelect(currentUser, els) { ...@@ -518,7 +518,7 @@ function UsersSelect(currentUser, els) {
<a href='#' class='dropdown-menu-user-link ${selected === true ? 'is-active' : ''}'> <a href='#' class='dropdown-menu-user-link ${selected === true ? 'is-active' : ''}'>
${img} ${img}
<strong class='dropdown-menu-user-full-name'> <strong class='dropdown-menu-user-full-name'>
${user.name} ${_.escape(user.name)}
</strong> </strong>
${username ? `<span class='dropdown-menu-user-username'>${username}</span>` : ''} ${username ? `<span class='dropdown-menu-user-username'>${username}</span>` : ''}
</a> </a>
...@@ -643,11 +643,11 @@ UsersSelect.prototype.formatResult = function(user) { ...@@ -643,11 +643,11 @@ UsersSelect.prototype.formatResult = function(user) {
} else { } else {
avatar = gon.default_avatar_url; avatar = gon.default_avatar_url;
} }
return "<div class='user-result " + (!user.username ? 'no-username' : void 0) + "'> <div class='user-image'><img class='avatar avatar-inline s32' src='" + avatar + "'></div> <div class='user-name dropdown-menu-user-full-name'>" + user.name + "</div> <div class='user-username dropdown-menu-user-username'>" + (!user.invite ? "@" + _.escape(user.username) : "") + "</div> </div>"; return "<div class='user-result " + (!user.username ? 'no-username' : void 0) + "'> <div class='user-image'><img class='avatar avatar-inline s32' src='" + avatar + "'></div> <div class='user-name dropdown-menu-user-full-name'>" + _.escape(user.name) + "</div> <div class='user-username dropdown-menu-user-username'>" + (!user.invite ? "@" + _.escape(user.username) : "") + "</div> </div>";
}; };
UsersSelect.prototype.formatSelection = function(user) { UsersSelect.prototype.formatSelection = function(user) {
return user.name; return _.escape(user.name);
}; };
UsersSelect.prototype.user = function(user_id, callback) { UsersSelect.prototype.user = function(user_id, callback) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment