ghaymah_dev/postal
1
1
Fork 0
mirror of https://github.com/postalserver/postal.git synced 2026-10-19 18:56:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deliveries): escape delivery details to prevent HTML injection

Browse Source
This commit is contained in:
Adam Cooke
2026-02-01 14:48:54 +00:00
parent b7e5232e07
commit 11419f9914
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/helpers/application_helper.rb
+1
View File
@@ -3,6 +3,7 @@
module ApplicationHelper module ApplicationHelper
def format_delivery_details(server, text) def format_delivery_details(server, text)
text = h(text)
text.gsub!(/<msg:(\d+)>/) do text.gsub!(/<msg:(\d+)>/) do
id = ::Regexp.last_match(1).to_i id = ::Regexp.last_match(1).to_i
link_to("message ##{id}", organization_server_message_path(server.organization, server, id), class: "u-link") link_to("message ##{id}", organization_server_message_path(server.organization, server, id), class: "u-link")