Skip to content

Commit

Permalink
Improve the formatting of the converted budgeting projects
Browse files Browse the repository at this point in the history
- Apply the same presenter content methods to budgeting project
  converting that the presenters are using.
- Improve the test to check for specific tags in the content and
  title
  • Loading branch information
ahukkanen committed Mar 7, 2019
1 parent 50a3521 commit 0db3245
Show file tree
Hide file tree
Showing 4 changed files with 18 additions and 9 deletions.
4 changes: 2 additions & 2 deletions app/controllers/decidim/plans/plans_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ class PlansController < Decidim::Plans::ApplicationController

helper_method :attached_proposals_picker_field

before_action :authenticate_user!, only: [:new, :create, :edit, :update, :withdraw, :preview, :publish, :close, :reopen, :destroy]
before_action :authenticate_user!, only: [:new, :create, :edit, :update, :withdraw, :preview, :publish, :close, :destroy]
before_action :check_draft, only: [:new]
before_action :retrieve_plan, only: [:show, :edit, :update, :withdraw, :preview, :publish, :close, :reopen, :destroy]
before_action :retrieve_plan, only: [:show, :edit, :update, :withdraw, :preview, :publish, :close, :destroy]
before_action :ensure_published!, only: [:show, :withdraw]

def index
Expand Down
4 changes: 2 additions & 2 deletions app/helpers/decidim/plans/links_helper.rb
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ module Decidim
module Plans
module LinksHelper
# This is for generating the links so that they maintain the search status
def request_params(extra_params={}, exclude_params=[])
def request_params(extra_params = {}, exclude_params = [])
@request_params ||= request.params.except(
*(exclude_params + [
:action,
Expand All @@ -17,7 +17,7 @@ def request_params(extra_params={}, exclude_params=[])
).merge(prepare_extra_params(extra_params))
end

def request_params_query(extra_params={}, exclude_params=[])
def request_params_query(extra_params = {}, exclude_params = [])
return "" unless request_params(extra_params, exclude_params).any?

"?#{request_params.to_query}"
Expand Down
2 changes: 1 addition & 1 deletion app/presenters/concerns/decidim/plans/rich_presenter.rb
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ def rich_content(content)
protected

def allowed_rich_tags
["strong", "em", "b", "i"]
%w(strong em b i)
end
end
end
Expand Down
17 changes: 13 additions & 4 deletions spec/commands/decidim/plans/admin/export_plans_to_budgets_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,14 @@
end

context "when the plans contain malicious HTML" do
let(:malicious_content) { "<script>alert('XSS');</script>" }
let(:malicious_content_array) do
[
"<script>alert('XSS');</script>",
"<img src='https://www.decidim.org'>",
"<a href='http://www.decidim.org'>Link</a>"
]
end
let(:malicious_content) { malicious_content_array.join("\n") }

let!(:plans) do
create_list(
Expand Down Expand Up @@ -94,12 +101,14 @@
end
end

it "should sanitize the malicious content" do
it "sanitizes the malicious content" do
command.call

Decidim::Budgets::Project.all.each do |project|
expect(project.title).not_to include(malicious_content)
expect(project.description).not_to include(malicious_content)
malicious_content_array.each do |mc|
expect(project.title).not_to include(mc)
expect(project.description).not_to include(mc)
end
end
end
end
Expand Down

0 comments on commit 0db3245

Please sign in to comment.