Skip to content

Commit 649eaca

Browse files
authored
Fix/escape space name description (#459)
* Ranaming `master` branch to `main`. * Escape space name and description to avoid xss. * Comment out irods dependency as it is not available anymore. * Upgrade actions/cache from v1 to v3
1 parent 2b31119 commit 649eaca

File tree

5 files changed

+6
-5
lines changed

5 files changed

+6
-5
lines changed

app/controllers/Spaces.scala

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import org.joda.time.DateTime
77
import play.api.data.Forms._
88
import play.api.data.{Form, Forms}
99
import play.api.i18n.Messages
10+
import play.api.templates.HtmlFormat
1011
import play.api.{Logger, Play}
1112
import securesocial.core.providers.{Token, UsernamePasswordProvider}
1213
import services._
@@ -411,7 +412,7 @@ class Spaces @Inject() (spaces: SpaceService, users: UserService, events: EventS
411412
formData => {
412413
if (Permission.checkPermission(user, Permission.CreateSpace)) {
413414
Logger.debug("Creating space " + formData.name)
414-
val newSpace = ProjectSpace(name = formData.name, description = formData.description,
415+
val newSpace = ProjectSpace(name = HtmlFormat.escape(formData.name).toString(), description = HtmlFormat.escape(formData.description).toString(),
415416
created = new Date, creator = userId, homePage = formData.homePage,
416417
logoURL = formData.logoURL, bannerURL = formData.bannerURL,
417418
collectionCount = 0, datasetCount = 0, fileCount = 0, userCount = 0, spaceBytes = 0, metadata = List.empty,

app/views/spaces/listItem.scala.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ <h3><a href="@routes.Spaces.getSpace(space.id)">@space.name</a></h3>
2222

2323
<div class= "row">
2424
<div class="col-md-6 col-sm-6 col-lg-6">
25-
<div class = 'abstractsummary'>@Html(space.description.replace("\n","<br>"))</div>
25+
<div class = 'abstractsummary'>space.description.replace("\n","<br>")</div>
2626
<div>@space.created.format("MMM dd, yyyy")</div>
2727
<div>
2828
<span class="glyphicon glyphicon-briefcase" title="@space.datasetCount datasets"></span> @space.datasetCount

app/views/spaces/newEditTemplate.scala.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ol class="breadcrumb">
1414
@(spaceId, spaceName) match {
1515
case (Some(s), Some(name)) => {
16-
<li> <span class="glyphicon glyphicon-hdd"></span> <a href="@routes.Spaces.getSpace(s)" title="@name"> @Html(ellipsize(name, 18))</a></li>
16+
<li> <span class="glyphicon glyphicon-hdd"></span> <a href="@routes.Spaces.getSpace(s)" title="@name"> @name</a></li>
1717
<li> <span class="glyphicon glyphicon-edit"></span> @Html(title)</li>
1818
}
1919
case (_,_) => {

app/views/spaces/space.scala.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<h1 id="spacenamedisplay" class="space-title"><span class="glyphicon glyphicon-hdd"></span> @space.name</h1>
2929
</div>
3030
<div class="col-md-12">
31-
<p><span id="spacedescdisplay" class='abstract'>@Html(space.description.replace("\n","<br>"))</span></p>
31+
<p><span id="spacedescdisplay" class='abstract'>@space.description.replace("\n","<br>")</span></p>
3232
</div>
3333
@if(user.isDefined) {
3434
<div class="col-xs-12">

app/views/spaces/tile.scala.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
}
1414
<div class="caption break-word">
1515
<h4 class="no-overflow oneline"><a href="@routes.Spaces.getSpace(space.id)">@space.name</a></h4>
16-
<p class = 'abstractsummary'>@Html(space.description.replace("\n","<br>"))</p>
16+
<p class = 'abstractsummary'>@space.description.replace("\n","<br>")</p>
1717
</div>
1818
</div>
1919
<!-- Space Info -->

0 commit comments

Comments
 (0)