public
Fork of halorgium/mephisto
Description: A mirror of the mephisto code-base
Homepage: http://mephistoblog.com/
Clone URL: git://github.com/technoweenie/mephisto.git
Click here to lend your support to: mephisto and make a donation at www.pledgie.com !
allow tables in sanitized comments

git-svn-id: http://svn.techno-weenie.net/projects/mephisto/trunk@2528 
567b1171-46fb-0310-a4c9-b4bef9110e78
technoweenie (author)
Wed Dec 06 18:59:28 -0800 2006
commit  b4cffbb0394cd454b383b2afd0e667297aef54d6
tree    b891774f5d9f2d0a3ffab88f0640e6eadf8f87d5
parent  1b252a48bb2e3db3a0db819bfc148b3c189d6dbe
...
55
56
57
58
59
60
61
62
63
64
65
66
67
68
...
55
56
57
 
 
 
 
 
 
 
 
58
59
60
0
@@ -55,14 +55,6 @@ class ApplicationHelperTest < Test::Unit::TestCase
0
     assert_match assets(:png).public_filename, asset_image_for(assets(:png))
0
   end
0
 
0
- def test_should_not_sanitize_tables
0
- assert_equal "&lt;table&gt;", sanitize_feed_content('<table>')
0
- end
0
-
0
- def test_should_sanitize_tables
0
- assert_equal "&amp;lt;table&gt;", sanitize_feed_content('<table>', true)
0
- end
0
-
0
   protected
0
     def asset_image_args_for(*args)
0
       controller.send(:asset_image_args_for, *args)
...
316
317
318
319
320
321
322
 
323
324
325
...
316
317
318
 
 
 
 
319
320
321
322
0
@@ -316,10 +316,7 @@ class MephistoControllerTest < Test::Unit::TestCase
0
   def test_should_sanitize_comment
0
     date = contents(:welcome).published_at
0
     dispatch "#{date.year}/#{date.month}/#{date.day}/welcome-to-mephisto"
0
- evil = %(<p>rico&#8217;s evil <script>hi</script> and <a onclick="foo" href="#">linkage</a></p>)
0
- good = %(<p>rico&#8217;s evil &lt;script>hi&lt;/script> and <a href='#'>linkage</a></p>)
0
- assert !@response.body.include?(evil), "includes unsanitized code"
0
- assert @response.body.include?(good), "does not include sanitized code"
0
+ assert !@response.body.include?('script'), "'#{@response.body}' includes unsanitized code"
0
   end
0
 
0
   def test_should_show_comments_form

Comments

    No one has commented yet.