history: Update posting history escaping method

yona-projects · Apr 15, 2017 · 97169d5 · 97169d5
1 parent 645f6f1
commit 97169d5
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 9 deletions.
diff --git a/app/controllers/AbstractPostingApp.java b/app/controllers/AbstractPostingApp.java
@@ -27,6 +27,7 @@
 import models.enumeration.Operation;
 import models.resource.Resource;
 import org.apache.commons.lang3.ArrayUtils;
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.commons.lang3.StringUtils;
 import play.data.Form;
 import play.db.ebean.Model;
@@ -187,25 +188,25 @@ private static String getDiffText(String oldValue, String newValue) {
                 switch (diff.operation) {
                     case DELETE:
                         sb.append("<span class='diff-deleted'>");
-                        sb.append(diff.text.replaceAll("\n", "&nbsp;\n"));
+                        sb.append(StringEscapeUtils.escapeHtml4(diff.text).replaceAll("\n", "&nbsp<br/>\n"));
                         sb.append("</span>");
                         break;
                     case EQUAL:
                         int textLength = diff.text.length();
                         if(textLength > EQUAL_TEXT_ELLIPSIS_SIZE) {
-                            sb.append(diff.text.substring(0, 150))
+                            sb.append(StringEscapeUtils.escapeHtml4(diff.text.substring(0, 150)))
                                     .append("<span class='diff-ellipsis'>...\n")
                                     .append("......\n")
                                     .append("......\n")
                                     .append("...</span>")
-                                    .append(diff.text.substring(textLength - 150));
+                                    .append(StringEscapeUtils.escapeHtml4(diff.text.substring(textLength - 150)));
                         } else {
-                            sb.append(diff.text);
+                            sb.append(StringEscapeUtils.escapeHtml4(diff.text));
                         }
                         break;
                     case INSERT:
                         sb.append("<span class='diff-added'>");
-                        sb.append(diff.text.replaceAll("\n", "&nbsp;\n"));
+                        sb.append(StringEscapeUtils.escapeHtml4(diff.text).replaceAll("\n", "&nbsp<br/>\n"));
                         sb.append("</span>");
                         break;
                     default:

diff --git a/app/models/Issue.java b/app/models/Issue.java
@@ -52,7 +52,7 @@ public class Issue extends AbstractPosting implements LabelOwner {
     public static final String TO_BE_ASSIGNED = "";
     public static final Pattern ISSUE_PATTERN = Pattern.compile("#\\d+");
 
-    public State state;
+    public State state = State.OPEN;
 
     @Formats.DateTime(pattern = "yyyy-MM-dd")
     public Date dueDate;

diff --git a/app/utils/Markdown.java b/app/utils/Markdown.java
@@ -124,7 +124,7 @@ private static String checkReferrer(String source) {
         return source;
     }
 
-    private static String sanitize(String source) {
+    public static String sanitize(String source) {
         return  sanitizerPolicy.sanitize(source);
     }
 

diff --git a/app/views/common/partial_history.scala.html b/app/views/common/partial_history.scala.html
@@ -7,7 +7,7 @@
 @(posting:models.AbstractPosting)
 
 @import utils.TemplateHelper._
-@import utils.HtmlUtil
+@import utils.Markdown
 
 <div id="-yona-posting-history" class="modal hide">
     <div class="modal-header">
@@ -16,7 +16,7 @@ <h5 class="nm">@Messages("change.history")</h5>
     </div>
     <div class="modal-body">
         <p>
-            @Html(HtmlUtil.defaultSanitize(posting.history))
+            @Html(Markdown.sanitize(posting.history))
         </p>
     </div>
     <div class="modal-footer">