diff options
| -rw-r--r-- | FS/FS/Mason.pm | 10 | ||||
| -rwxr-xr-x | httemplate/view/cust_main/notes.html | 4 |
2 files changed, 12 insertions, 2 deletions
diff --git a/FS/FS/Mason.pm b/FS/FS/Mason.pm index be16bbb27..4c8c808cd 100644 --- a/FS/FS/Mason.pm +++ b/FS/FS/Mason.pm @@ -70,6 +70,7 @@ if ( -e $addl_handler_use_file ) { use HTML::Entities; use HTML::TreeBuilder; use HTML::FormatText; + use HTML::Defang; use JSON; use MIME::Base64; use IO::Handle; @@ -408,6 +409,8 @@ I<outbuf> should be set to a scalar reference in standalone mode. =cut +my %defang_opts = ( attribs_to_callback => ['src'], attribs_callback => sub { 1 }); + sub mason_interps { my $mode = shift || 'apache'; my %opt = @_; @@ -451,6 +454,8 @@ sub mason_interps { $interp{out_method} = $opt{outbuf} if $mode eq 'standalone' && $opt{outbuf}; + my $html_defang = new HTML::Defang (%defang_opts); + my $fs_interp = new HTML::Mason::Interp ( %interp, escape_flags => { 'js_string' => sub { @@ -458,7 +463,10 @@ sub mason_interps { ${$_[0]} =~ s/(['\\])/\\$1/g; ${$_[0]} =~ s/\n/\\n/g; ${$_[0]} = "'". ${$_[0]}. "'"; - } + }, + 'defang' => sub { + ${$_[0]} = $html_defang->defang(${$_[0]}); + }, }, compiler => HTML::Mason::Compiler::ToObject->new( allow_globals => [qw(%session)], diff --git a/httemplate/view/cust_main/notes.html b/httemplate/view/cust_main/notes.html index a6378f46a..a39610ac5 100755 --- a/httemplate/view/cust_main/notes.html +++ b/httemplate/view/cust_main/notes.html @@ -53,7 +53,7 @@ <% $note->otaker%> </TD> <TD CLASS="grid" BGCOLOR="<% $bgcolor %>"> - <%$note->comments%> + <% $note->comments | defang %> </TD> % if($edit) { <TD CLASS="grid" BGCOLOR="<% $bgcolor %>"><% $edit %></TD> @@ -67,6 +67,8 @@ % } <%init> +use HTML::Defang; + my $conf = new FS::Conf; my $curuser = $FS::CurrentUser::CurrentUser; |