Image URLs are not properly escaped in the bundled RedCloth3 library.
It thus allowed an XSS vector.
The patch was adapted from r7570 from Redmine by Etiene Massip. See also
http://www.redmine.org/issues/9245.
Fixes#2038 and #3707 and will allow to support TOC with other text formatters.
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4376 e93f8b46-1217-0410-a6f0-8f06a7374b81
Patch supplied by commits from Gerrit Kaiser on Github. Existing routes will
still work (backwards compatible) but any new urls will be generated using the
new routing rules.
Changes listed below:
* made the URLs for some project tabs and project settings follow the new rails RESTful conventions of /collection/:id/subcollection/:sub_id
* prettier URL for project roadmap
* more nice project URLs
* use GET for filtering form
* prettified URLs used on issues tab
* custom route for activity atom feeds
* prettier repository urls
* fixed broken route definition
* fixed failing tests for issuecontroller that were hardcoding the url string
* more RESTful routes for boards and messages
* RESTful routes for wiki pages
* RESTful routes for documents
* moved old routes that are retained for compatibility to the bottom and grouped them together
* added RESTful URIs for issues
* RESTfulness for the news section
* fixed route order
* changed hardcoded URLs in tests
* fixed badly written tests
* fixed forgotten parameter in routes
* changed hardcoded URLS to new scheme
* changed project add url to the standard POST to collection
* create new issue by POSTing to collection
* changed hardcoded URLs in integrations tests
* made project add form work again
* restful routes for project deletion
* prettier routes for project (un)archival
* made routes table more readable
* fixed note quoting
* user routing
* fixed bug
* always sort by GET
* Fixed: cross-project issue list should not show issues of projects for which the issue tracking module was disabled.
* prettified URLs used on issues tab
* urls for time log
* fixed reply routing
* eliminate revision query paremeter for diff and entry actions
* fixed test failures with hard-coded urls
* ensure ajax links always use get
* refactored ajax link generation into separate method
#1901
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2317 e93f8b46-1217-0410-a6f0-8f06a7374b81
It can also be called from anywhere now (not only from wiki pages).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2053 e93f8b46-1217-0410-a6f0-8f06a7374b81
Holger Just
Eric Davis
Jean-Philippe Lang
Jean-Baptiste Barth