BigW Consortium Gitlab
Remove persistent XSS vulnerability in `commit_person_link` helper Because we were incorrectly supplying the tooltip title as `data-original-title` (which Bootstrap's Tooltip JS automatically applies based on the `title` attribute; we should never be setting it directly), the value was being passed through as-is. Instead, we should be supplying the normal `title` attribute and letting Rails escape the value, which also negates the need for us to call `sanitize` on it. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126 See merge request !1948
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
admin | Loading commit data... | |
atom | Loading commit data... | |
issues | Loading commit data... | |
merge_requests | Loading commit data... | |
profiles | Loading commit data... | |
projects/badges | Loading commit data... | |
security | Loading commit data... | |
builds_spec.rb | Loading commit data... | |
ci_lint_spec.rb | Loading commit data... | |
commits_spec.rb | Loading commit data... | |
dashboard_issues_spec.rb | Loading commit data... | |
dashboard_milestones_spec.rb | Loading commit data... | |
gitlab_flavored_markdown_spec.rb | Loading commit data... | |
groups_spec.rb | Loading commit data... | |
help_pages_spec.rb | Loading commit data... | |
issues_spec.rb | Loading commit data... | |
login_spec.rb | Loading commit data... | |
markdown_spec.rb | Loading commit data... | |
notes_on_merge_requests_spec.rb | Loading commit data... | |
participants_autocomplete_spec.rb | Loading commit data... | |
password_reset_spec.rb | Loading commit data... | |
profile_spec.rb | Loading commit data... | |
projects_spec.rb | Loading commit data... | |
runners_spec.rb | Loading commit data... | |
search_spec.rb | Loading commit data... | |
signup_spec.rb | Loading commit data... | |
task_lists_spec.rb | Loading commit data... | |
triggers_spec.rb | Loading commit data... | |
users_spec.rb | Loading commit data... | |
variables_spec.rb | Loading commit data... |