raggedstaff/openfoodnetwork
1
0
Fork 0
mirror of https://github.com/openfoodfoundation/openfoodnetwork synced 2026-01-24 20:36:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't use :html_safe in case shipping method name contains something malicious in app/views/admin/order_cycles/checkout_options.html.haml

Browse Source 
Co-authored-by: Maikel <maikel@email.org.au>
This commit is contained in:
Cillian O'Ruanaidh
2022-06-20 21:48:04 +01:00
committed by Filipe
parent d9de35799d
commit 7bd56007bd
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/admin/order_cycles/checkout_options.html.haml
View File

@@ -61,7 +61,9 @@
= input.check_box
= input.label
%p
= "&mdash;<em>#{shared_shipping_method.distributors.where(id: @order_cycle.distributor_ids).map(&:name).join(", ")}</em>".html_safe
&mdash
%em>
= shared_shipping_method.distributors.where(id: @order_cycle.distributor_ids).map(&:name).join(", ")
%td
- if shared_payment_methods.any?
%ul