Merging 1.2rc into master

app/views/delayed_job_failures/index.html.haml

@@ -23,19 +23,19 @@
           - @delayed_job_failures.each do |e|
             - index += 1
             %dt
-              %strong= e.summary
+              %strong= h e.summary
               at
-              %em= e.created_at
+              %em= h e.created_at
             %dd
-              = e.details
+              = h e.details
               - if e.backtrace
                 %div.expandable-list
                   = link_to h('Backtrace'), {}, {:class => 'expandable-link collapsed-link', :id => "expand-#{index}"}
                   %div.expandable.collapsed{:id => "expandable-#{index}"}
                     %table
                       - e.backtrace.each do |bt|
                         %tr
-                          %td= bt
+                          %td= h bt
         = pagination_for @delayed_job_failures
       - else
         %p No unread task failures.

app/views/layouts/application.html.haml

@@ -33,7 +33,7 @@
               .close= link_to_function icon(:close), "jQuery('#flash').hide()"
               %p
                 = icon(type)
-                = message
+                = h message
         = yield
       #footer
         %p= link_to "© Copyright #{Time.now.year} Puppet Labs", 'http://puppetlabs.com/'

app/views/node_classes/_form.html.haml

@@ -3,7 +3,7 @@
 = header_for(form)
 
 .item
-  = form.error_messages
+  = h form.error_messages
 
   .element
     = form.label :name

app/views/node_classes/index.html.haml

@@ -10,16 +10,12 @@
   %table.main
     %thead
       %tr
-        -# %th.check
-          -# = check_box_tag "check_all"
-        %th.name{:scope => :col}
+        %th.name
           Name
     - if @node_classes.present?
       %tbody
         - for node_class in @node_classes
           %tr[node_class]
-            -# %td.check
-              -# = check_box_tag "check_all"
             %td.name
               = link_to h(node_class.name), node_class
       %tfoot

app/views/node_classes/show.html.haml

@@ -3,7 +3,7 @@
   .header
     %h2
       Class:
-      = @node_class.name
+      = h @node_class.name
     %ul.actions
       - unless SETTINGS.enable_read_only_mode || session['ACCESS_CONTROL_ROLE'] == 'READ_ONLY'
         %li= link_to 'Edit', edit_node_class_path(@node_class), :class => "edit button"

app/views/node_groups/index.html.haml

@@ -10,16 +10,12 @@
   %table.main
     %thead
       %tr
-        -# %th.check
-          -# = check_box_tag "check_all"
-        %th.name{:scope => :col}
+        %th.name
           Name
     - if @node_groups.present?
       %tbody
         - for node_group in @node_groups
           %tr[node_group]
-            -# %td.check
-              -# = check_box_tag "check_all"
             %td.name
               = link_to h(node_group.name), node_group
       %tfoot

app/views/node_groups/show.html.haml

@@ -3,7 +3,7 @@
   .header
     %h2
       Group:
-      = @node_group.name
+      = h @node_group.name
     %ul.actions
       - unless SETTINGS.enable_read_only_mode || session['ACCESS_CONTROL_ROLE'] == 'READ_ONLY'
         %li= link_to 'Edit', edit_node_group_path(@node_group), :class => "edit button", :rel => 'inspect'
@@ -28,12 +28,12 @@
             - @node_group.node_group_children_with_sources.sort.each do |group,sources|
               %tr
                 %td
-                  %strong= link_to(group.name,group)
+                  %strong= link_to(h(group.name), group)
                 %td
                   - if sources.include?(@node_group)
-                    = group.name
+                    = h group.name
                   - else
-                    = sources.map{|p| link_to(p.name,p)}.join(", ")
+                    = sources.map{|p| link_to(h(p.name), p)}.join(", ")
       - else
         = describe_no_matches_as 'No child groups'
     .clearfix{:style => 'clear: both'}

app/views/nodes/_form.html.haml

@@ -9,7 +9,7 @@
     = form.label :node, "Node"
     - if @readonly_name
       %p
-        = @node.name
+        = h @node.name
     - else
       = form.text_field :name, :placeholder => "Enter the node name here"
 

app/views/nodes/_inspections.html.haml

@@ -15,7 +15,7 @@
         - node.reports.inspections.limit(reports_limit).each do |report|
           %tr
             = report_status_td(report)
-            %td= link_to report.time, report
+            %td= link_to h(report.time), report
             %td= report.total_resources
             %td= report.total_time
       - if node.reports.inspections.count > reports_limit

app/views/nodes/_nodes.html.haml

@@ -22,22 +22,22 @@
   %table.main
     %thead
       %tr
-        %th.empty{:scope => :col, :colspan => container.nil? ? 3 : 4}
+        %th.empty{:colspan => container.nil? ? 3 : 4}
           = link_to "Export nodes as CSV", url_for(:controller => "nodes", :action => selected_status == "all" ? :index : selected_status, :format => 'csv')
         - unless column_filter[ selected_status ] && column_filter[ selected_status ].empty?
-          %th{:scope => :col, :colspan => "5"}
+          %th(colspan="5")
             Resources
       %tr
-        %th.status{:scope => :col}
-        %th.node{:scope => :col}
+        %th.status
+        %th.node
           Node
         - unless container.nil?
-          %th{:scope => :col} Source
-        %th.latest_report.desc{:scope => :col}
+          %th Source
+        %th.latest_report.desc
           ↓ Latest report
         - column_filter[ selected_status ].each do |status|
-          %th{:scope => :col}
-            = status.capitalize
+          %th
+            = h status.capitalize
     %tfoot
       %tr
         %td{:colspan => container.nil? ? 8 : 9 }
@@ -57,9 +57,9 @@
           - unless container.nil?
             %td
               - if sources.include?(container)
-                = node.name
+                = h node.name
               - else
-                = sources.map{|s| link_to(s.name,s)}.join(", ")
+                = sources.map{|s| link_to(h(s.name), s)}.join(", ")
           %td.latest_report
             = node.last_apply_report ? link_to(h(node.last_apply_report.time), node.last_apply_report) : "Has not reported"
           - column_filter[ selected_status ].each do |status|

app/views/nodes/index.html.haml

@@ -4,7 +4,7 @@
   .header
     %h2.half
       - if action_name != 'index'
-        = action_name.titleize.capitalize
+        = h action_name.titleize.capitalize
         nodes
       - else
         Nodes

app/views/pages/_node_summary_row.haml

@@ -6,7 +6,7 @@
   %td.count
     %span= nodes.length
   %td
-    %span.label= title
+    %span.label= h title
     %em= "#{percentage(nodes)}%"
     %br/
     %hr{:style => "width: #{percentage(nodes)}%"}

app/views/pages/home.html.haml

@@ -11,9 +11,9 @@
     %ul#home-tabs.tabbed
       - tab_statuses.each do |tab_status|
         %li(id="#{tab_status}-tab")
-          %a{:href => "#"}= tab_status.humanize
+          %a{:href => "#"}= h tab_status.humanize
     - tab_statuses.each do |tab_status|
-      %div.panel(id=tab_status)
+      %div.panel(id = tab_status)
         = render 'nodes/nodes',
           :nodes           => instance_variable_get("@#{tab_status}_nodes"),
           :selected_status => tab_status,

app/views/puppet/transaction/reports/_report.haml

@@ -1,12 +1,12 @@
 -# FIXME Is anything using this partial?
 .report.grouping
-  %h2= report.time
+  %h2= h report.time
 
   .section
     %h3 Metrics
     - report.metrics.each do |name, metric|
       %table.inspector
-        %caption= name.capitalize
+        %caption= h name.capitalize
         = render metric
 
   .section

app/views/puppet/util/logs/_log.haml

@@ -10,4 +10,4 @@
   %td
     %code= h log.line
   %td.nowrap
-    %code= log.time
+    %code= h log.time

app/views/reports/_metrics.html.haml

@@ -3,7 +3,7 @@
   - if report.metrics.present?
     - report.metrics.group_by(&:category).sort.each do |category, metrics_in_category|
       .section
-        %h4= category.titleize
+        %h4= h category.titleize
         %table.inspector
           = render :partial => 'metrics/metrics_table', :locals => {:metrics => metrics_in_category}
   - else

app/views/reports/_report.html.haml

@@ -17,7 +17,7 @@
         %div.panel(id="#{user_facing[name].downcase}")
           = widget.call self, report
       %li(id="#{user_facing[name].downcase}-tab")
-        %a= user_facing[name]
+        %a= h user_facing[name]
   = panels
 
 - Registry.each_callback :report, :tail do |thing|

app/views/reports/_report_title.html.haml

@@ -1,6 +1,6 @@
 %span.status{:class => report.status}
   = report_status_icon(report)
   Report: 
-  = link_to report.time, report
+  = link_to h(report.time), report
 %span.alt for
-= link_to report.node.name, report.node
+= link_to h(report.node.name), report.node

app/views/reports/_reports_table.html.haml

@@ -29,7 +29,7 @@
       - for report in reports
         %tr.nowrap[report]
           = report_status_td(report)
-          %td= link_to report.time, report
+          %td= link_to h(report.time), report
           - unless node
             %td= link_to_if report.node, h(report.host), node_path(report.node)
           %td= report.total_resources.to_i

app/views/reports/_resource_statuses.html.haml

@@ -11,20 +11,20 @@
             - index += 1
             %dt{:class => cycle( 'odd', 'even' )}
               - if status.events.empty?
-                %span{:class => 'non-expandable-bullet'}= status.name
+                %span{:class => 'non-expandable-bullet'}= h status.name
               - else
                 = link_to h(status.name), {}, {:class => 'expandable-link collapsed-link', :id => "expand-#{index}"}
               - if status.file or status.line
-                = "(#{status.file}:#{status.line})"
+                = h "(#{status.file}:#{status.line})"
             %dd.expandable.collapsed{:id => "expandable-#{index}"}
               %table
                 %tr
                   %th{:scope => :col} Property
                   %th{:scope => :col} Message
                 - status.events.each do |event|
                   %tr{:class => "status #{event.status}"}
-                    %td= event.property
-                    %td= popup_md5s( h(event.message), :exclude_md5s => [event.desired_value])
+                    %td= h event.property
+                    %td= popup_md5s(h(event.message), :exclude_md5s => [event.desired_value])
           %br
   - else
     %h3 Events

app/views/reports/index.html.haml

@@ -5,7 +5,7 @@
       Reports
       - if @node
         %span.alt for
-        = link_to @node.name, @node
+        = link_to h(@node.name), @node
       %span.count== (#{@reports.total_entries})
 
   .item

app/views/reports/search.html.haml

@@ -12,7 +12,7 @@
         - flash[:errors].each do |messages|
           %p
             - messages.each do |message|
-              %li= message
+              %li= h message
 
     .section
       - form_tag url_for(:action => :search), :method => :get do
@@ -38,6 +38,6 @@
               - results.each do |file|
                 %tr
                   = report_status_td(file.report)
-                  %td= link_to file.report.time, file.report
+                  %td= link_to h(file.report.time), file.report
                   %td= link_to h(file.report.host), file.report.node
                   %td= file.events.detect {|event| event.property == "content"}.previous_value.gsub("{md5}","") rescue "not recorded"

app/views/shared/_classes.html.haml

@@ -10,12 +10,12 @@
         - resource.node_classes_with_sources.each do |node_class,sources|
           %tr
             %td.name
-              %strong= link_to(node_class.name,node_class)
+              %strong= link_to(h(node_class.name),node_class)
             %td
               - if sources.include?(resource)
-                = resource.name
+                = h resource.name
               - else
-                = sources.map{|source| link_to(source.name,source)}.join(", ")
+                = sources.map{|source| link_to(h(source.name),source)}.join(", ")
   - else
     = describe_no_matches_as 'No classes'
 %br.clear

app/views/shared/_global_nav.html.haml

@@ -9,7 +9,7 @@
           - css << "width: #{SETTINGS.custom_logo_width}"
           %a{:href => root_path, :title => SETTINGS.custom_logo_alt_text, :style => css.join('; ')} Puppet Dashboard
         %li#dashboard-version{:class => active_if(request.url == release_notes_url)}
-          = link_to APP_VERSION, APP_VERSION_LINK
+          = link_to h(APP_VERSION), APP_VERSION_LINK
         %li#navigation-home{:class => active_if(request.url == root_url)}
           = link_to "Home", root_path
         %li#navigation-nodes{:class => active_if(controller_name == "nodes" && action_name == "index")}

app/views/shared/_groups.html.haml

@@ -10,11 +10,11 @@
         - resource.node_groups_with_sources.sort.each do |group,sources|
           %tr
             %td
-              %strong= link_to(group.name,group)
+              %strong= link_to(h(group.name),group)
             %td
               - if sources.include?(resource)
-                = resource.name
+                = h resource.name
               - else
-                = sources.map{|source| link_to(source.name,source)}.join(", ")
+                = sources.map{|source| link_to(h(source.name),source)}.join(", ")
   - else
     = describe_no_matches_as 'No groups'

app/views/shared/_inspector.html.haml

@@ -1,14 +1,14 @@
 %table.inspector
   - if options[:caption]
-    %caption= options[:caption]
+    %caption= h options[:caption]
   %thead
     %tr
-      %th.key{:scope => :col}= (options[:key_title] || key).to_s.titleize
+      %th.key= h (options[:key_title] || key).to_s.titleize
       - unless options[:key_only]
-        %th.value{:scope => :col, :colspan => 2}= (options[:value_title] || value).to_s.titleize
+        %th.value{:colspan => 2}= h (options[:value_title] || value).to_s.titleize
   %tbody
     - inspector.each do |key, value|
       %tr
-        %td.key= key
+        %td.key= h key
         - unless options[:key_only]
-          %td{:colspan => 2}= value
+          %td{:colspan => 2}= h value