ylqjgm
/
canvas-lms
mirror of https://github.com/instructure/canvas-lms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
canvas-lms/app/models
History
Jon Jensen d9f5c589da use RailsXss::Erubis for html email templates, fixes CNVS-5414 
prevent malicious or accidental html content from getting through (e.g.
via translations or interpolated user content).

slight refactor in message.rb to make it more easily testable

test plan:
1. spot check html emails, make sure they look ok
2. ensure you can't get arbitrary html into an email, e.g.
   1. change your name in canvas to "<b>ZOMG</b>"
   2. send someone a message in canvasations
   3. check the html email that got sent to them. your name should appear
      as "<b>ZOMG</b>", and not "ZOMG" in bold text

Change-Id: Ie638a0d3d28427f25c0fa1ce89c10533802b0c6b
Reviewed-on: https://gerrit.instructure.com/19827
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
 		2013-04-23 16:56:53 +00:00
..
discussion_topic arel-ify models 2013-04-01 18:42:38 +00:00
quiz_question don't stomp a variable in quiz stats 2013-04-21 06:48:51 +00:00
quiz_statistics quiz item analysis generation, closes CNVS-3421 2013-04-23 15:50:36 +00:00
abstract_course.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
access_token.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
account.rb fix no_enrollments_can_create_courses flag 2013-04-23 15:54:39 +00:00
account_authorization_config.rb support multiple SAML private keys for decryption 2013-03-15 14:31:57 -06:00
account_notification.rb arel-ify models 2013-04-01 18:42:38 +00:00
account_report.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
account_user.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
alert.rb arel-ify models 2013-04-01 18:42:38 +00:00
alert_criterion.rb alerts, closes #4317 2011-08-24 10:19:44 -06:00
announcement.rb properly persist disable announcement comments setting. 2013-02-14 16:40:18 -07:00
appointment_group.rb speed up scheduler 2013-04-05 23:03:53 +00:00
appointment_group_context.rb multiple contexts per appointment group 2012-04-30 15:30:03 -06:00
appointment_group_sub_context.rb multiple contexts per appointment group 2012-04-30 15:30:03 -06:00
assessment_question.rb basic support for file upload quiz question type 2013-04-19 21:42:13 +00:00
assessment_question_bank.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
assessment_question_bank_user.rb Initial commit. 2011-01-31 18:57:29 -07:00
assessment_request.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
asset_user_access.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
assignment.rb more i18n fixes 2013-04-22 15:34:18 +00:00
assignment_group.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
assignment_override.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
assignment_override_student.rb arel-ify models 2013-04-01 18:42:38 +00:00
attachment.rb put statistics.csv in an attachment 2013-04-17 17:22:56 +00:00
attachment_association.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
authorization_code.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
big_blue_button_conference.rb use global_id for the BBB voiceBridge number 2012-08-16 09:22:22 -06:00
bookmark_service.rb i18n Bookmark Service 2011-06-16 07:16:10 -06:00
calendar_event.rb add migration warnings for missing references in html content 2013-04-11 18:28:59 +00:00
cloned_item.rb make sure links in assessment questions are correctly translated, fixes #6012 2011-10-21 08:36:34 -06:00
collaboration.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
collaborator.rb add groups to collaborators table, add api endpoint. 2013-01-04 20:18:04 -07:00
collection.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
collection_item.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
collection_item_data.rb get rspec 2 running with rails 3.0 2013-03-27 15:41:28 +00:00
collection_item_upvote.rb arel-ify models 2013-04-01 18:42:38 +00:00
communication_channel.rb Add API for admins to access user messages 2013-04-11 19:38:02 +00:00
content_export.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
content_migration.rb allow content migrations to be hidden in the ui 2013-04-16 21:48:31 +00:00
content_participation.rb arel-ify models 2013-04-01 18:42:38 +00:00
content_participation_count.rb arel-ify models 2013-04-01 18:42:38 +00:00
content_tag.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
context.rb course batch update api 2013-01-29 14:06:03 -07:00
context_external_tool.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
context_module.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
context_module_item.rb don't preload all a module's progressions 2013-03-11 08:41:32 -06:00
context_module_progression.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
context_module_sub_header.rb optimize AdheresToPolicy 2011-07-14 13:25:28 -06:00
conversation.rb fix Converstation#delete_for_all to work for multi-shard conversations 2013-04-12 19:26:42 +00:00
conversation_batch.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
conversation_message.rb switch to Shackles gem 2013-04-17 16:25:06 +00:00
conversation_message_participant.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
conversation_participant.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
course.rb use 'unpublished' (not 'created' or 'claimed') in courses api 2013-04-20 01:36:23 +00:00
course_account_association.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
course_import.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
course_profile.rb context profiles, refs CNVS-2650 2013-02-01 17:57:07 -07:00
course_section.rb don't disallow deleting a section due to StudentViewEnrollments 2013-04-02 15:02:58 +00:00
crocodoc_document.rb arel-ify models 2013-04-01 18:42:38 +00:00
delayed_message.rb Add API for admins to access user messages 2013-04-11 19:38:02 +00:00
delayed_notification.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
designer_enrollment.rb straighten out course designer permissions 2012-01-13 18:56:50 -07:00
developer_key.rb allow 3rd parties to use oauth for authentication 2013-03-18 14:53:29 -06:00
dim_dim_conference.rb wimba integration, fixes #2989 2011-02-25 14:35:14 -07:00
discussion_entry.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
discussion_entry_participant.rb discussion topics materialized view api, refs #7567 2012-03-22 12:49:49 -06:00
discussion_topic.rb add migration warnings for missing references in html content 2013-04-11 18:28:59 +00:00
discussion_topic_participant.rb ensure unread_entry_counts never drop below 0. 2013-02-28 13:23:01 -07:00
document_service.rb Initial commit. 2011-01-31 18:57:29 -07:00
enrollment.rb add computed_(current|final)_grade to users for courses api 2013-04-15 23:19:26 +00:00
enrollment_dates_override.rb term start/term end, rather than whenever 2011-09-13 15:20:15 -06:00
enrollment_term.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
eportfolio.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
eportfolio_category.rb localize ePortfolios 2011-06-24 13:17:25 -06:00
eportfolio_entry.rb 1.9 - fix eportfolios 2012-05-17 23:10:51 -06:00
error_report.rb switch to Shackles gem 2013-04-17 16:25:06 +00:00
etherpad_collaboration.rb remove deprecated rails constant usage 2013-03-11 12:14:08 -06:00
external_feed.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
external_feed_entry.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
external_url.rb optimize AdheresToPolicy 2011-07-14 13:25:28 -06:00
favorite.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
folder.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
google_docs_collaboration.rb Initial commit. 2011-01-31 18:57:29 -07:00
gradebook_upload.rb prepare for foreign keys refs #6895 2012-05-10 09:46:05 -06:00
grading_standard.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
group.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
group_category.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
group_membership.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
ignore.rb arel-ify models 2013-04-01 18:42:38 +00:00
inbox_item.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
learning_outcome.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
learning_outcome_group.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
learning_outcome_result.rb simplify SimplyVersioned option storage and add callbacks 2013-04-20 13:20:29 +00:00
mailer.rb add multiple reply-to support to outgoing mail. 2013-02-22 14:02:27 -07:00
media_object.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
media_track.rb Allow uploading subtitle tracks to videos 2013-02-01 12:53:16 -07:00
message.rb use RailsXss::Erubis for html email templates, fixes CNVS-5414 2013-04-23 16:56:53 +00:00
migration_issue.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
notification.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
notification_policy.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
oauth_request.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
observer_enrollment.rb arel-ify models 2013-04-01 18:42:38 +00:00
open_object.rb Initial commit. 2011-01-31 18:57:29 -07:00
page_comment.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
page_view.rb EventStream abstraction 2013-04-19 19:05:14 +00:00
plugin_setting.rb proactively clear cache when changing plugin settings 2012-10-29 12:11:31 -06:00
profile.rb custom profile field fixes/enhancements, refs CNVS-4556 2013-03-28 16:08:04 +00:00
progress.rb track quiz_statistics.csv progress 2013-04-18 21:54:00 +00:00
pseudonym.rb allow apostrophes in pseudonym unique_id field. 2013-04-15 16:49:16 +00:00
pseudonym_session.rb require a password login for certain sensitive actions closes #6401 2012-08-02 10:22:48 -06:00
quiz.rb i18n fixes 2013-04-19 19:14:10 +00:00
quiz_group.rb show re-publish button when editing a quiz question group 2013-03-15 09:19:12 -06:00
quiz_question.rb arel-ify models 2013-04-01 18:42:38 +00:00
quiz_statistics.rb groundwork for background generation of quiz stats 2013-04-18 21:54:10 +00:00
quiz_submission.rb put statistics.csv in an attachment 2013-04-17 17:22:56 +00:00
quiz_submission_snapshot.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
report_snapshot.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
role.rb add users from courses/:id/users page 2013-04-18 19:43:54 +00:00
role_override.rb include attribute to exclude permissions based on plugins 2013-04-22 16:36:24 +00:00
rubric.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
rubric_assessment.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
rubric_association.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
scribd_account.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
scribd_mime_type.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
session_persistence_token.rb switch to ruby stdlib SecureRandom 2013-03-28 20:49:31 +00:00
setting.rb remove deprecated rails constant usage 2013-03-11 12:14:08 -06:00
sis_batch.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
stream_item.rb fix Converstation#delete_for_all to work for multi-shard conversations 2013-04-12 19:26:42 +00:00
stream_item_instance.rb arel-ify lib 2013-04-01 19:12:22 +00:00
student_enrollment.rb Minor fixes to StudentEnrollment associations. 2012-05-04 16:46:43 -06:00
student_view_enrollment.rb student view; closes #6995 2012-04-03 14:11:07 -06:00
submission.rb populate submission versions 2013-04-20 13:20:47 +00:00
submission_comment.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
submission_comment_participant.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
submission_version.rb populate submission versions 2013-04-20 13:20:47 +00:00
ta_enrollment.rb straighten out course designer permissions 2012-01-13 18:56:50 -07:00
tableless.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
teacher_enrollment.rb straighten out course designer permissions 2012-01-13 18:56:50 -07:00
thumbnail.rb update thumbnail attachment options like Attachment's 2013-03-26 18:46:14 +00:00
user.rb don't include "DESC" in the select when ordering by sortable name 2013-04-22 17:49:22 +00:00
user_account_association.rb clean up user account associations 2013-01-31 10:41:55 -07:00
user_follow.rb arel-ify models 2013-04-01 18:42:38 +00:00
user_note.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
user_observer.rb user co-enrollment backend work, closes #8588 2012-05-23 12:21:00 -06:00
user_profile.rb include root_account in section_tabs cache key 2012-08-17 14:15:10 -06:00
user_profile_link.rb add data validation to user profile links 2012-09-24 15:38:26 -06:00
user_service.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
web_conference.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
web_conference_participant.rb check all models for protecting attributes refs #3847 2011-05-25 17:38:50 -06:00
wiki.rb don't error on course export if the course name is too long 2013-02-05 10:21:20 -07:00
wiki_page.rb add migration warnings for missing references in html content 2013-04-11 18:28:59 +00:00
wiki_page_comment.rb arel-ify scopes 2013-04-01 21:57:16 +00:00
wimba_conference.rb handle wimba conference date parsing in ruby18/ruby19. 2013-02-08 12:43:19 -07:00
zip_file_import.rb use ids relative to the default shard for strands refs #6886 2012-04-02 09:47:09 -06:00