summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--FS/FS/Mason.pm10
-rwxr-xr-xhttemplate/view/cust_main/notes.html4
2 files changed, 12 insertions, 2 deletions
diff --git a/FS/FS/Mason.pm b/FS/FS/Mason.pm
index be16bbb27..4c8c808cd 100644
--- a/FS/FS/Mason.pm
+++ b/FS/FS/Mason.pm
@@ -70,6 +70,7 @@ if ( -e $addl_handler_use_file ) {
use HTML::Entities;
use HTML::TreeBuilder;
use HTML::FormatText;
+ use HTML::Defang;
use JSON;
use MIME::Base64;
use IO::Handle;
@@ -408,6 +409,8 @@ I<outbuf> should be set to a scalar reference in standalone mode.
=cut
+my %defang_opts = ( attribs_to_callback => ['src'], attribs_callback => sub { 1 });
+
sub mason_interps {
my $mode = shift || 'apache';
my %opt = @_;
@@ -451,6 +454,8 @@ sub mason_interps {
$interp{out_method} = $opt{outbuf} if $mode eq 'standalone' && $opt{outbuf};
+ my $html_defang = new HTML::Defang (%defang_opts);
+
my $fs_interp = new HTML::Mason::Interp (
%interp,
escape_flags => { 'js_string' => sub {
@@ -458,7 +463,10 @@ sub mason_interps {
${$_[0]} =~ s/(['\\])/\\$1/g;
${$_[0]} =~ s/\n/\\n/g;
${$_[0]} = "'". ${$_[0]}. "'";
- }
+ },
+ 'defang' => sub {
+ ${$_[0]} = $html_defang->defang(${$_[0]});
+ },
},
compiler => HTML::Mason::Compiler::ToObject->new(
allow_globals => [qw(%session)],
diff --git a/httemplate/view/cust_main/notes.html b/httemplate/view/cust_main/notes.html
index a6378f46a..a39610ac5 100755
--- a/httemplate/view/cust_main/notes.html
+++ b/httemplate/view/cust_main/notes.html
@@ -53,7 +53,7 @@
&nbsp;<% $note->otaker%>
</TD>
<TD CLASS="grid" BGCOLOR="<% $bgcolor %>">
- &nbsp;<%$note->comments%>
+ &nbsp;<% $note->comments | defang %>
</TD>
% if($edit) {
<TD CLASS="grid" BGCOLOR="<% $bgcolor %>"><% $edit %></TD>
@@ -67,6 +67,8 @@
% }
<%init>
+use HTML::Defang;
+
my $conf = new FS::Conf;
my $curuser = $FS::CurrentUser::CurrentUser;