Fixes #35977 - html_escape host-comment in index

(cherry picked from commit b7f865d)
theforeman · Jan 27, 2023 · 9dc1c46 · 9dc1c46
1 parent 454fe23
commit 9dc1c46
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/app/views/hosts/_list.html.erb b/app/views/hosts/_list.html.erb
@@ -32,7 +32,7 @@
         <td hidden="true" class="hidden-tablet hidden-xs ellipsis"><%= host_owner_column(host) %></td>
         <td hidden="true" class="hidden-tablet hidden-xs"><%= label_with_link host.hostgroup, 23, @hostgroup_authorizer %></td>
         <td hidden="true" class="hidden-tablet hidden-xs ellipsis"><%= last_report_column(host) %></td>
-        <td hidden="true" class="hidden-tablet hidden-xs ca" title="<%= host.comment&.truncate(255) %>"><%= icon_text('comment', '') unless host.comment.empty? %></td>
+        <td hidden="true" class="hidden-tablet hidden-xs ca" title="<%= h host.comment&.truncate(255) %>"><%= icon_text('comment', '') unless host.comment.empty? %></td>
 	<td>
           <%= action_buttons(
                       display_link_if_authorized(_("Edit"), hash_for_edit_host_path(:id => host).merge(:auth_object => host, :authorizer => authorizer)),

diff --git a/config/initializers/foreman_register.rb b/config/initializers/foreman_register.rb
@@ -24,7 +24,7 @@
     add_pagelet :hosts_table_column_header, key: :last_report, label: _('Last report'), sortable: true, default_sort: 'DESC', width: '10%', class: common_th_class
     add_pagelet :hosts_table_column_content, key: :last_report, class: common_td_class, callback: ->(host) { last_report_column(host) }
     add_pagelet :hosts_table_column_header, key: :comment, label: _('Comment'), sortable: true, width: '7%', class: common_th_class
-    add_pagelet :hosts_table_column_content, key: :comment, class: common_th_class + ' ca', attr_callbacks: { title: ->(host) { host.comment&.truncate(255) } }, callback: ->(host) { icon_text('comment', '') unless host.comment.empty? }
+    add_pagelet :hosts_table_column_content, key: :comment, class: common_th_class + ' ca', attr_callbacks: { title: ->(host) { h host.comment&.truncate(255) } }, callback: ->(host) { icon_text('comment', '') unless host.comment.empty? }
   end
   ctx.with_profile :network_data, _('Network'), default: false do
     common_th_class = 'hidden-tablet hidden-xs'