Queue name xss, fixes sidekiq#2330

presto53 · May 4, 2015 · 2178d66 · 2178d66
1 parent a695ff3
commit 2178d66
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/web/views/queue.erb b/web/views/queue.erb
@@ -1,7 +1,7 @@
 <header class="row">
   <div class="col-sm-5">
     <h3>
-      <%= t('CurrentMessagesInQueue', :queue => @name) %>
+      <%= t('CurrentMessagesInQueue', :queue => h(@name)) %>
       <% if @queue.paused? %>
         <span class="label label-danger"><%= t('Paused') %></span>
       <% end %>

diff --git a/web/views/queues.erb b/web/views/queues.erb
@@ -17,7 +17,7 @@
       <td><%= number_with_delimiter(queue.size) %> </td>
       <td width="20%">
         <form action="<%=root_path %>queues/<%= queue.name %>" method="post">
-          <input class="btn btn-danger btn-xs" type="submit" name="delete" value="<%= t('Delete') %>" data-confirm="<%= t('AreYouSureDeleteQueue', :queue => queue.name) %>" />
+          <input class="btn btn-danger btn-xs" type="submit" name="delete" value="<%= t('Delete') %>" data-confirm="<%= t('AreYouSureDeleteQueue', :queue => h(queue.name)) %>" />
         </form>
       </td>
     </tr>