added sanitize statements to hopefully all critical templates to protect against cross site scripting.

added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list 

5 files changed, 9 insertions, 9 deletions

diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb
index 2eb0c4d..9eb7d7e 100644
--- a/app/helpers/content_helper.rb
+++ b/app/helpers/content_helper.rb
@@ -85,13 +85,13 @@ module ContentHelper
         
         options[:partial] = select_partial( options[:partial] )
 
-        content.sub(tag, render_collection(options))
+        sanitize( content.sub(tag, render_collection(options)) )
       else
-        content
+        sanitize( content )
       end
       
     rescue
-      content
+      sanatize( content )
     end
   end
   
diff --git a/app/views/content/_front_page_calendar.html.erb b/app/views/content/_front_page_calendar.html.erb
index 1a409a6..e7f46ba 100644
--- a/app/views/content/_front_page_calendar.html.erb
+++ b/app/views/content/_front_page_calendar.html.erb
@@ -4,7 +4,7 @@
     <% occurrences.each do |occurrence| %>
       <li>
         <div><%= l occurrence.start_time.to_date, :format => :default %></div>
-        <%= link_to_path occurrence.node.head.title, occurrence.node.unique_name %>
+        <%= link_to_path sanitize( occurrence.node.head.title ), occurrence.node.unique_name %>
       </li>
     <% end %>
   </ul>
diff --git a/app/views/custom/page_templates/public/no_date_and_author.html.erb b/app/views/custom/page_templates/public/no_date_and_author.html.erb
index 08911ff..ef60961 100644
--- a/app/views/custom/page_templates/public/no_date_and_author.html.erb
+++ b/app/views/custom/page_templates/public/no_date_and_author.html.erb
@@ -1,7 +1,7 @@
 <div class="article">
   <h2><%= @page.title %></h2>
   <hr class="subtitle" />
-  <p><em><%= @page.abstract %></em></p>
+  <p><em><%= sanitize( @page.abstract ) %></em></p>
   <div id="headline_image"><%= headline_image %></div>
   <%= aggregate?(@page.body) %>
 </div>
diff --git a/app/views/custom/page_templates/public/standard_template.html.erb b/app/views/custom/page_templates/public/standard_template.html.erb
index 9ce3e94..d4c80aa 100644
--- a/app/views/custom/page_templates/public/standard_template.html.erb
+++ b/app/views/custom/page_templates/public/standard_template.html.erb
@@ -2,7 +2,7 @@
   <h2><%= @page.title %></h2>
   <h3><%= date_for_page @page %>, <%= @page.user.try(:login) %></h3>
   <hr class="subtitle" />
-  <p><em><%= @page.abstract %></em></p>
+  <p><em><%= sanitize( @page.abstract )%></em></p>
   <div id="headline_image"><%= headline_image %></div>
   <%= aggregate?(@page.body) %>
 </div>
diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index 8f56c7c..99fb264 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -36,15 +36,15 @@
     </tr>
     <tr>
       <td class="description"><strong>Title</strong></td>
-      <td><%= @page.title %></td>
+      <td><%= sanitize( @page.title ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Abstract</strong></td>
-      <td><%= @page.abstract %></td>
+      <td><%= sanitize( @page.abstract ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Body</strong></td>
-      <td><%= @page.body %></td>
+      <td><%= sanitize( @page.body ) %></td>
     </tr>
     <tr>
       <td></td>