added sanitize statements to hopefully all critical templates to protect against cross site scripting.

added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list 

1 files changed, 13 insertions, 3 deletions

diff --git a/config/environment.rb b/config/environment.rb
index bff2a70..18415aa 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -30,9 +30,19 @@ Rails::Initializer.run do |config|
   # :all can be used as a placeholder for all plugins not explicitly named
   # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
 
-  # Skip frameworks you're not going to use. To use Rails without a database,
-  # you must remove the Active Record framework.
-  # config.frameworks -= [ :active_record, :active_resource, :action_mailer ]
+  # Allowed Tags
+  # strong em b i p code pre tt samp kbd var sub sup dfn cite big small 
+  # address hr br div span h1 h2 h3 h4 h5 h6 ul ol li dt dd abbr 
+  # acronym a img blockquote del ins
+  
+  # Allowed Attributes:
+  # href src width height alt cite datetime title class name xml:lang abbr))
+  
+  # Add tags to whitelist with:
+  # config.action_view.sanitized_allowed_tags = 'table', 'tr', 'td'
+  
+  # Add attributes to whitelist with:
+  # config.action_view.sanitized_allowed_attributes = 'id', 'class', 'style'
 
   # Activate observers that should always be running
   # config.active_record.observers = :cacher, :garbage_collector, :forum_observer