mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-06 09:11:11 +08:00
ab402b7aee
This update fixes a XSS issue where a XSS was permitted in the review queue via the `highlightWatchedWords` function leading to arbitrary JS execution when in moderator context.
38 lines
831 B
Ruby
38 lines
831 B
Ruby
# frozen_string_literal: true
|
|
|
|
class ReviewableQueuedPostSerializer < ReviewableSerializer
|
|
attributes :reply_to_post_number, :fancy_title, :cooked
|
|
|
|
payload_attributes(
|
|
:raw,
|
|
:title,
|
|
:archetype,
|
|
:category,
|
|
:visible,
|
|
:is_warning,
|
|
:first_post_checks,
|
|
:featured_link,
|
|
:is_poll,
|
|
:typing_duration_msecs,
|
|
:composer_open_duration_msecs,
|
|
:tags,
|
|
:via_email,
|
|
:raw_email,
|
|
)
|
|
|
|
def fancy_title
|
|
ERB::Util.html_escape(object.payload["title"]) if object.payload&.[]("title")
|
|
end
|
|
|
|
def cooked
|
|
PrettyText.cook(object.payload["raw"]) if object.payload&.[]("raw")
|
|
end
|
|
|
|
def reply_to_post_number
|
|
object.payload["reply_to_post_number"].to_i
|
|
end
|
|
|
|
def include_reply_to_post_number?
|
|
object.payload.present? && object.payload["reply_to_post_number"].present?
|
|
end
|
|
end
|
