[Git][noosfero/noosfero][stable-1.2] 18 commits: favorite-enterprises-block: add view-all class to footer link and fix translation

Antonio Terceiro gitlab at gitlab.com
Tue Oct 13 14:47:26 BRT 2015


Antonio Terceiro pushed to branch stable-1.2 at Noosfero / noosfero


Commits:
d1ef35be by Rodrigo Souto at 2015-10-13T12:00:31Z
favorite-enterprises-block: add view-all class to footer link and fix translation

(cherry picked from commit 09c3d5b0b68508285c0f6afaaa9f76720aec7d5d)

- - - - -
dd8f5c4d by Rodrigo Souto at 2015-10-13T12:00:32Z
profile-list-block: move view-all link to the bottom

With some translations the view all button gets overlaped by the title.

(cherry picked from commit 2d94b1d500518df58027f8c679c30e11f4e3da6b)

- - - - -
aa71e503 by Rodrigo Souto at 2015-10-13T12:00:32Z
favorite-enterprises-block: add its class to the proper css definition

(cherry picked from commit 20bb372127925572495708d817c1aefb3418b911)

- - - - -
c621a194 by Rodrigo Souto at 2015-10-13T12:00:32Z
avoid html double escape

This is already handled on rails 3.

Fix #62

(cherry picked from commit 5640070915e3b18a29e3a941dc96a603529fb40c)

- - - - -
9a333732 by Antonio Terceiro at 2015-10-13T12:00:33Z
plugins: drop `require 'rubygems'` statements

On Ruby 1.9+ these are no-ops

(cherry picked from commit 41bd751985bbf11b3bc8707d8b691fdc07d2a8fe)

- - - - -
49f28e09 by Antonio Terceiro at 2015-10-13T12:00:33Z
plugins/ldap: add missing dependency declaration

(cherry picked from commit 9c497c0bb53de7df26c76e7bdb4dfb639cd06c5a)

- - - - -
91e77c8f by Rodrigo Souto at 2015-10-13T12:00:33Z
backup: make tasks rails_env aware

(cherry picked from commit 7d617038d64d41cca34b1c36b4e2f99a3373e97a)

- - - - -
e36845fb by Antonio Terceiro at 2015-10-13T12:00:34Z
vagrant: setup catch-all email alias for @localhost.localdomain

this helps local tests, since one can use ANYTHING at localhost.localdomain
for registering users

(cherry picked from commit e01744f23ea4a0f411ddc60fb8720e03abeaf7db)

- - - - -
efc5b986 by Antonio Terceiro at 2015-10-13T12:00:34Z
restore:remove_emails: removes actual emails from database

This is useful when you are loading a database dump from a production
database for local tests, and you don't want people's emails there in
order to avoid accidental outgoing email.

(cherry picked from commit 83d521927f8c2aa9684c38f0e2ccc81cbbbd6aa4)

- - - - -
230bd714 by Daniela Feitosa at 2015-10-13T12:04:26Z
Give more space to text-editor-sidebar

(cherry picked from commit 4dd11514eb9995c23171987f554421ccb965b82b)

- - - - -
a7b4f2a9 by Daniela Feitosa at 2015-10-13T12:07:28Z
Remove "Manage Roles" option for person

Only organizations can manage roles

(cherry picked from commit eb4178406f1c00d43543884c734efe486fe66c7b)

- - - - -
4b57f104 by Thiago Ribeiro at 2015-10-13T12:07:33Z
Fix image address in highlightBlock when in subdir

Signed-off-by: Thiago Ribeiro <thiagitosouza at gmail.com>
Signed-off-by: Simião Carvalho <simiaosimis at gmail.com>
Signed-off-by: Daniela Soares Feitosa <danielafeitosa at colivre.coop.br>

Closes merge request !688

(cherry picked from commit 70d40ab534163196c225ab27289b34a7b865b416)

- - - - -
bcaf32ef by Larissa Reis at 2015-10-13T12:07:33Z
newsletter: Fixes string internationalization for mailing

Only marking the strings for translation with `N_()` wasn't enough and
strings weren't being translated for mailing.

(cherry picked from commit 117471e2132b5ec348d3daebfa38c7be33db5272)

- - - - -
81f66511 by Arthur Del Esposte at 2015-10-13T12:07:34Z
Consider subdirectory in some images path

Signed-off-by: Rodrigo Souto <rodrigo at colivre.coop.br>
Signed-off-by: Arthur Del Esposte <arthurmde at gmail.com>
(cherry picked from commit 48b50f8829052e384c1c78ba70051fb70c72d716)

- - - - -
6e71206f by Arthur Del Esposte at 2015-10-13T12:07:34Z
Include missed helper in Environment Notification Plugin

(cherry picked from commit c62a8f56bc09ab0315a50e0247beff1e5e90ffde)

- - - - -
3efdf029 by Luciano Prestes Cavalcanti at 2015-10-13T12:10:05Z
Fix highlights_block error on add Noosfero.root

Signed-off-by: Luciano Prestes Cavalcanti <lucianopcbr at gmail.com>
Signed-off-by: Thiago Ribeiro <thiagitosouza at hotmail.com>
(cherry picked from commit 74a61295d8e5bda43670d2cc283b0fe473b69929)

- - - - -
7708334a by Aurélio A. Heckert at 2015-10-13T12:10:06Z
Better custom forms submissions display

Also does some security enhancement for custom forms by sanitizing
content.

(cherry picked from commit c3f4ea2b96b37539085f36aa0f7be48128a8f054)

- - - - -
8dc25e91 by Larissa Reis at 2015-10-13T12:10:06Z
custom_forms: small bug fixes in datepick and remove field

  - Fixes slide up of field box when removing a field, since the outer
  box was being left behind and only the content was being slided up.
  - Fixes date pick on Firefox/Iceweasel, which was not showing the date
  stored on the database and instead was always being initialized with
  the current date because the format with dashes '1995-12-17 03:24:00'
  is not a valid date format for Date(), while '1995-12-17T03:24:00' or
  '1995/12/17 03:24:00' are correct formats.

(cherry picked from commit d693abc49c4fcdeb851db093c1c437ac52b9e857)

- - - - -


48 changed files:

- app/models/article.rb
- app/models/favorite_enterprises_block.rb
- app/models/highlights_block.rb
- app/views/blocks/highlights.html.erb
- app/views/cms/media_panel/_image.html.erb
- app/views/profile_editor/index.html.erb
- lib/tasks/backup.rake
- plugins/custom_forms/lib/custom_forms_plugin/answer.rb
- plugins/custom_forms/lib/custom_forms_plugin/helper.rb
- plugins/custom_forms/lib/custom_forms_plugin/submission.rb
- plugins/custom_forms/public/field.js
- plugins/custom_forms/public/style.css
- plugins/custom_forms/views/custom_forms_plugin_myprofile/_form.html.erb
- plugins/custom_forms/views/custom_forms_plugin_myprofile/show_submission.html.erb
- plugins/custom_forms/views/custom_forms_plugin_profile/show.html.erb
- plugins/environment_notification/controllers/public/environment_notification_plugin_public_controller.rb
- plugins/lattes_curriculum/lib/html_parser.rb
- plugins/ldap/Gemfile
- plugins/ldap/dependencies.rb
- plugins/ldap/lib/ldap_authentication.rb
- plugins/newsletter/lib/newsletter_plugin/newsletter.rb
- plugins/solr/dependencies.rb
- plugins/solr/install.rb
- plugins/solr/vendor/plugins/acts_as_solr_reloaded/Rakefile
- plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/acts_as_solr/tasks.rb
- plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/solr/xml.rb
- plugins/solr/vendor/plugins/acts_as_solr_reloaded/solr_test_rakefile.rb
- plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/test_helper.rb
- plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/unit/test_helper.rb
- plugins/spaminator/dependencies.rb
- public/designs/themes/base/style.css
- public/stylesheets/application.css
- script/vagrant
- test/functional/profile_editor_controller_test.rb
- test/unit/article_test.rb
- test/unit/comment_test.rb
- test/unit/community_test.rb
- test/unit/environment_test.rb
- test/unit/event_test.rb
- test/unit/folder_test.rb
- test/unit/gallery_test.rb
- test/unit/highlights_block_test.rb
- test/unit/organization_test.rb
- test/unit/product_test.rb
- test/unit/profile_test.rb
- test/unit/text_article_test.rb
- test/unit/validation_info_test.rb
- vendor/plugins/xss_terminate/lib/xss_terminate.rb


Changes:

=====================================
app/models/article.rb
=====================================
--- a/app/models/article.rb
+++ b/app/models/article.rb
@@ -788,7 +788,7 @@ class Article < ActiveRecord::Base
   end
 
   def first_image
-    img = ( image.present? && { 'src' => image.public_filename } ) ||
+    img = ( image.present? && { 'src' => File.join([Noosfero.root, image.public_filename].join) } ) ||
           Nokogiri::HTML.fragment(self.lead.to_s).css('img[src]').first ||
           Nokogiri::HTML.fragment(self.body.to_s).search('img').first
     img.nil? ? '' : img['src']


=====================================
app/models/favorite_enterprises_block.rb
=====================================
--- a/app/models/favorite_enterprises_block.rb
+++ b/app/models/favorite_enterprises_block.rb
@@ -16,7 +16,7 @@ class FavoriteEnterprisesBlock < ProfileListBlock
     owner = self.owner
     return '' unless owner.kind_of?(Person)
     proc do
-      link_to _('View all'), :profile => owner.identifier, :controller => 'profile', :action => 'favorite_enterprises'
+      link_to _('enterprises|View all'), {:profile => owner.identifier, :controller => 'profile', :action => 'favorite_enterprises'}, :class => 'view-all'
     end
   end
 


=====================================
app/models/highlights_block.rb
=====================================
--- a/app/models/highlights_block.rb
+++ b/app/models/highlights_block.rb
@@ -12,7 +12,9 @@ class HighlightsBlock < Block
     block.images.each do |i|
       i[:image_id] = i[:image_id].to_i
       i[:position] = i[:position].to_i
-      i[:address] = Noosfero.root + i[:address]  unless Noosfero.root.nil?
+      if !Noosfero.root.nil? and !i[:address].start_with?(Noosfero.root + '/')
+        i[:address] = Noosfero.root + i[:address]
+      end
       begin
         file = UploadedFile.find(i[:image_id])
         i[:image_src] = file.public_filename


=====================================
app/views/blocks/highlights.html.erb
=====================================
--- a/app/views/blocks/highlights.html.erb
+++ b/app/views/blocks/highlights.html.erb
@@ -4,7 +4,7 @@
     <div class='highlights-container'>
       <% block.featured_images.each do |img| %>
         <a href="<%= img[:address] %>" title="<%= img[:title] %>" class="highlights-image-link">
-          <%= content_tag :img, nil, :src => img[:image_src], :alt => img[:title] %>
+          <%= image_tag [Noosfero.root, img[:image_src]].join, alt: img[:title] %>
           <p class="highlights-label"><%= img[:title] %></p>
         </a>
       <% end %>


=====================================
app/views/cms/media_panel/_image.html.erb
=====================================
--- a/app/views/cms/media_panel/_image.html.erb
+++ b/app/views/cms/media_panel/_image.html.erb
@@ -1,6 +1,6 @@
 <div class="item image" data-item="span" title="<%= @file.name %>">
   <span>
-    <img src="<%= @file.public_filename(:uploaded) %>"/>
+    <%= image_tag(@file.public_filename(:uploaded)) %>
   </span>
   <div class="controls image-controls">
     <a class="button icon-add add-to-text" href="#"><span><%= _('Add to the text') %></span></a>


=====================================
app/views/profile_editor/index.html.erb
=====================================
--- a/app/views/profile_editor/index.html.erb
+++ b/app/views/profile_editor/index.html.erb
@@ -28,7 +28,7 @@
 
   <%= control_panel_button(_('Manage Content'), 'cms', :controller => 'cms') %>
 
-  <%= control_panel_button(_('Manage Roles'), 'roles', :controller => 'profile_roles') %>
+  <%= control_panel_button(_('Manage Roles'), 'roles', :controller => 'profile_roles') if profile.organization? %>
 
   <% unless profile.enterprise? %>
     <%= case profile.blogs.count


=====================================
lib/tasks/backup.rake
=====================================
--- a/lib/tasks/backup.rake
+++ b/lib/tasks/backup.rake
@@ -18,14 +18,15 @@ backup_dirs = [
 desc "Creates a backup of the database and uploaded files"
 task :backup => :check_backup_support do
   dirs = backup_dirs.select { |d| File.exists?(d) }
+  rails_env = ENV["RAILS_ENV"] || 'production'
 
   backup_name = Time.now.strftime('%Y-%m-%d-%R')
   backup_file = File.join('tmp/backup', backup_name) + '.tar.gz'
   mkdir_p 'tmp/backup'
   dump = File.join('tmp/backup', backup_name) + '.sql'
 
-  database = $config['production']['database']
-  host = $config['production']['host']
+  database = $config[rails_env]['database']
+  host = $config[rails_env]['host']
   host = host && "-h #{host}" || ""
   sh "pg_dump #{host} #{database} > #{dump}"
 
@@ -52,6 +53,7 @@ end
 desc "Restores a backup created previousy with \`rake backup\`"
 task :restore => :check_backup_support do
   backup = ENV["BACKUP"]
+  rails_env = ENV["RAILS_ENV"] || 'production'
   unless backup
     puts "usage: rake restore BACKUP=/path/to/backup"
     exit 1
@@ -81,9 +83,9 @@ task :restore => :check_backup_support do
   end
   dump = dumps.first
 
-  database = $config['production']['database']
-  username = $config['production']['username']
-  host = $config['production']['host']
+  database = $config[rails_env]['database']
+  username = $config[rails_env]['username']
+  host = $config[rails_env]['host']
   host = host && "-h #{host}" || ""
 
   puts "WARNING: backups should be restored to an empty database, otherwise"
@@ -102,10 +104,39 @@ task :restore => :check_backup_support do
   end
 
   sh 'tar', 'xaf', backup
-  sh "rails dbconsole production < #{dump}"
+  sh "rails dbconsole #{rails_env} < #{dump}"
   rm_f dump
 
   puts "****************************************************"
   puts "Backup restored!"
   puts "****************************************************"
 end
+
+desc 'Removes emails from database'
+task 'restore:remove_emails' => :environment do
+  connection = ActiveRecord::Base.connection
+  [
+    "UPDATE users SET email = concat('user', id, '@localhost.localdomain')",
+    "UPDATE environments SET contact_email = concat('environment', id, '@localhost.localdomain')",
+  ].each do |update|
+    puts update
+    connection.execute(update)
+  end
+
+  profiles = connection.execute("select id, data from profiles")
+  profiles.each do |profile|
+    if profile['data']
+      data = YAML.load(profile['data'])
+      if data[:contact_email] && data[:contact_email] !~ /@localhost.localdomain$/
+        data[:contact_email] = ['profile', profile['id'], '@localhost.localdomain'].join
+        sql = Environment.send(:sanitize_sql, [
+          "UPDATE profiles SET data = ? WHERE id = ?",
+          YAML.dump(data),
+          profile['id'],
+        ])
+        puts sql
+        connection.execute(sql)
+      end
+    end
+  end
+end


=====================================
plugins/custom_forms/lib/custom_forms_plugin/answer.rb
=====================================
--- a/plugins/custom_forms/lib/custom_forms_plugin/answer.rb
+++ b/plugins/custom_forms/lib/custom_forms_plugin/answer.rb
@@ -14,10 +14,14 @@ class CustomFormsPlugin::Answer < ActiveRecord::Base
     end
   end
 
-  def to_s
-    return value if value.blank? || field.alternatives.blank?
+  def to_text_list
+    return [value] if value.blank? || field.alternatives.blank?
     selected = value.split(',')
-    field.alternatives.select {|alt| selected.include? alt.id.to_s }.map(&:label).join(';')
+    field.alternatives.select {|alt| selected.include? alt.id.to_s }.map(&:label)
+  end
+
+  def to_s
+    to_text_list.join(';')
   end
 end
 


=====================================
plugins/custom_forms/lib/custom_forms_plugin/helper.rb
=====================================
--- a/plugins/custom_forms/lib/custom_forms_plugin/helper.rb
+++ b/plugins/custom_forms/lib/custom_forms_plugin/helper.rb
@@ -69,12 +69,13 @@ module CustomFormsPlugin::Helper
   end
 
   def display_custom_field(field, submission, form)
+    sanitized_name = ActionView::Base.white_list_sanitizer.sanitize field.name
     answer = submission.answers.select{|answer| answer.field == field}.first
     field_tag = send("display_#{type_for_options(field.class)}",field, answer, form)
     if field.mandatory? && submission.id.nil?
-      required(labelled_form_field(field.name, field_tag))
+      required(labelled_form_field(sanitized_name, field_tag))
     else
-      labelled_form_field(field.name, field_tag)
+      labelled_form_field(sanitized_name, field_tag)
     end
   end
 


=====================================
plugins/custom_forms/lib/custom_forms_plugin/submission.rb
=====================================
--- a/plugins/custom_forms/lib/custom_forms_plugin/submission.rb
+++ b/plugins/custom_forms/lib/custom_forms_plugin/submission.rb
@@ -49,6 +49,14 @@ class CustomFormsPlugin::Submission < Noosfero::Plugin::ActiveRecord
     self.answers
   end
 
+  def q_and_a
+    qa = {}
+    form.fields.each do |f|
+      self.answers.select{|a| a.field == f}.map{|answer| qa[f] = answer }
+    end
+    qa
+  end
+
   protected
 
   def check_answers


=====================================
plugins/custom_forms/public/field.js
=====================================
--- a/plugins/custom_forms/public/field.js
+++ b/plugins/custom_forms/public/field.js
@@ -40,7 +40,7 @@ var customFormsPlugin = {
     if (confirm(confirmMsg)) {
       fb = jQuery(button).closest('.field-box');
       jQuery('input.destroy-field', fb).val(1);
-      jQuery('> div', fb).slideUp({easing:'linear', complete:function(){fb.slideUp({easing:'linear', duration:250})}});
+      jQuery(fb).slideUp(600, 'linear');
     }
   },
 


=====================================
plugins/custom_forms/public/style.css
=====================================
--- a/plugins/custom_forms/public/style.css
+++ b/plugins/custom_forms/public/style.css
@@ -89,3 +89,32 @@ tr.addition-buttons {
   border: 1px solid #BBB;
   border-radius: 4px;
 }
+
+#custom-forms-plugin_submission .notify {
+  padding: 8px;
+  color: rgba(0,0,0,0.5);
+}
+
+#custom-forms-plugin_submission-view th {
+  border: none;
+  text-align: right;
+}
+#custom-forms-plugin_submission-view td {
+  padding: 5px 0;
+}
+
+#custom-forms-plugin_submission-view td img {
+  vertical-align: middle;
+}
+
+#custom-forms-plugin_submission-view td ul {
+  padding: 0;
+  margin: 0;
+}
+#custom-forms-plugin_submission-view td li {
+  list-style: none;
+  background: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><rect x="3.5" y="3.5" width="10" height="10" fill="black" stroke="black" fill-opacity="0.2" opacity="0.4" ry="1"/><path d="M 4,5 8.5,13 16,0 8.5,8.5 z"/></svg>') no-repeat 0 50%;
+  padding: 0 0 0 20px;
+  margin: 0;
+}
+


=====================================
plugins/custom_forms/views/custom_forms_plugin_myprofile/_form.html.erb
=====================================
--- a/plugins/custom_forms/views/custom_forms_plugin_myprofile/_form.html.erb
+++ b/plugins/custom_forms/views/custom_forms_plugin_myprofile/_form.html.erb
@@ -5,7 +5,7 @@
 <%= required labelled_form_field _('Name'), f.text_field(:name) %>
 <%= labelled_form_field(_('What is the time limit for this form to be filled?'), (
   date_range_field('form[begining]', 'form[ending]', @form.begining, @form.ending,
-                   '%Y-%m-%d %H:%M',
+                   '%Y/%m/%d %H:%M',
                    { :time => true, :change_month => true, :change_year => true,
                      :date_format => 'yy-mm-dd', :time_format => 'hh:mm' },
                      { :size => 14 })


=====================================
plugins/custom_forms/views/custom_forms_plugin_myprofile/show_submission.html.erb
=====================================
--- a/plugins/custom_forms/views/custom_forms_plugin_myprofile/show_submission.html.erb
+++ b/plugins/custom_forms/views/custom_forms_plugin_myprofile/show_submission.html.erb
@@ -1,10 +1,51 @@
+<div id="custom-forms-plugin_submission-view">
+
 <h1><%= @form.name %></h1>
 <p><%= @form.description %></p>
 
-<%= fields_for :submission, @submission do |f| %>
-  <%= render :partial => 'shared/form_submission', :locals => {:f => f} %>
+<% sanitizer = ActionView::Base.white_list_sanitizer %>
+
+<table>
+  <tr>
+    <th><%= _('Submission date') %></th>
+    <td><%= @submission.updated_at.strftime('%Y/%m/%d %T %Z') %><td>
+  </tr>
+  <tr>
+    <th><%= _('Author') %></th>
+    <% if author = @submission.profile %>
+      <td>
+        <%= link_to(image_tag(profile_icon(author, :portrait)), author.url) %>
+        <%= link_to(author.name, author.url) %>
+      </td>
+    <% else %>
+      <td>
+        <%=
+          img = image_tag gravatar_profile_image_url @submission.author_email, :size=>64, :d => gravatar_default
+          sanitizer.sanitize link_to(img +' '+ @submission.author_name, "mailto:#{@submission.author_email}")
+        %>
+        <span>(<%= _('Unauthenticated') %>)<span>
+      </td>
+    <% end %>
+  </tr>
+<% @submission.q_and_a.each do |field, answer| %>
+  <tr>
+    <th><%= sanitizer.sanitize field.name %></th>
+    <td><%=
+      answer = if answer.field.alternatives.blank?
+        answer.to_s.gsub("\n", '<br>')
+      else
+        content_tag :ul do
+          answer.to_text_list.map {|a| content_tag :li, a }.join("\n")
+        end
+      end
+      sanitizer.sanitize answer
+    %></td>
+  </tr>
 <% end %>
+</table>
 
 <% button_bar do %>
   <%= button :back, _('Back to submissions'), :action => 'submissions', :id => @form.id %>
 <% end %>
+
+</div><!-- end id="custom-forms-plugin_submission-view" -->


=====================================
plugins/custom_forms/views/custom_forms_plugin_profile/show.html.erb
=====================================
--- a/plugins/custom_forms/views/custom_forms_plugin_profile/show.html.erb
+++ b/plugins/custom_forms/views/custom_forms_plugin_profile/show.html.erb
@@ -1,3 +1,5 @@
+<div id="custom-forms-plugin_submission">
+
 <h1><%= @form.name %></h1>
 <p><%= @form.description %></p>
 
@@ -26,6 +28,7 @@
       <% else %>
         <%= submit_button :save, c_('Save'), :cancel => {:controller => :profile, :profile => profile.identifier} %>
       <% end %>
+      <div class="notify"><%= _("Your e-mail will be visible to this form's owners.") %></div>
     <% end %>
 
   <% end %>
@@ -34,3 +37,5 @@
     <%= render :partial => 'shared/form_submission', :locals => {:f => f} %>
   <% end %>
 <% end %>
+
+</div><!-- end id="custom-forms-plugin_submission" -->


=====================================
plugins/environment_notification/controllers/public/environment_notification_plugin_public_controller.rb
=====================================
--- a/plugins/environment_notification/controllers/public/environment_notification_plugin_public_controller.rb
+++ b/plugins/environment_notification/controllers/public/environment_notification_plugin_public_controller.rb
@@ -1,6 +1,7 @@
 class EnvironmentNotificationPluginPublicController < PublicController
 
   helper EnvironmentNotificationHelper
+  include EnvironmentNotificationHelper
 
   def notifications_with_popup
     @hide_notifications = hide_notifications


=====================================
plugins/lattes_curriculum/lib/html_parser.rb
=====================================
--- a/plugins/lattes_curriculum/lib/html_parser.rb
+++ b/plugins/lattes_curriculum/lib/html_parser.rb
@@ -1,4 +1,3 @@
-require 'rubygems'
 require 'nokogiri'
 require 'open-uri'
 


=====================================
plugins/ldap/Gemfile
=====================================
--- a/plugins/ldap/Gemfile
+++ b/plugins/ldap/Gemfile
@@ -1 +1,2 @@
 gem "net-ldap"
+gem "magic", ">= 0.2.8"


=====================================
plugins/ldap/dependencies.rb
=====================================
--- a/plugins/ldap/dependencies.rb
+++ b/plugins/ldap/dependencies.rb
@@ -1,2 +1 @@
-require 'rubygems'
 require 'net/ldap'


=====================================
plugins/ldap/lib/ldap_authentication.rb
=====================================
--- a/plugins/ldap/lib/ldap_authentication.rb
+++ b/plugins/ldap/lib/ldap_authentication.rb
@@ -15,7 +15,6 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-require 'rubygems'
 require 'iconv'
 require 'net/ldap'
 require 'net/ldap/dn'


=====================================
plugins/newsletter/lib/newsletter_plugin/newsletter.rb
=====================================
--- a/plugins/newsletter/lib/newsletter_plugin/newsletter.rb
+++ b/plugins/newsletter/lib/newsletter_plugin/newsletter.rb
@@ -111,15 +111,15 @@ class NewsletterPlugin::Newsletter < Noosfero::Plugin::ActiveRecord
   include DatesHelper
 
   def message_to_public_link
-    content_tag(:p, N_("If you can't view this email, %s.") % link_to(N_('click here'), '{mailing_url}'), :id => 'newsletter-public-link')
+    content_tag(:p, _("If you can't view this email, %s.") % link_to(_('click here'), '{mailing_url}'), :id => 'newsletter-public-link')
   end
 
   def message_to_unsubscribe
-    content_tag(:div, N_("This is an automatically generated email, please do not reply. If you do not wish to receive future newsletter emails, %s.") % link_to(N_("cancel your subscription here"), self.unsubscribe_url, :style => CSS['public-link']), :style => CSS['newsletter-unsubscribe'], :id => 'newsletter-unsubscribe')
+    content_tag(:div, _("This is an automatically generated email, please do not reply. If you do not wish to receive future newsletter emails, %s.") % link_to(_("cancel your subscription here"), self.unsubscribe_url, :style => CSS['public-link']), :style => CSS['newsletter-unsubscribe'], :id => 'newsletter-unsubscribe')
   end
 
   def read_more(link_address)
-    content_tag(:p, link_to(N_('Read more'), link_address, :style => CSS['read-more-link']), :style => CSS['read-more-line'])
+    content_tag(:p, link_to(_('Read more'), link_address, :style => CSS['read-more-link']), :style => CSS['read-more-line'])
   end
 
   def post_with_image(post)
@@ -141,7 +141,7 @@ class NewsletterPlugin::Newsletter < Noosfero::Plugin::ActiveRecord
   end
 
   def default_subject
-    N_('Breaking news')
+    _('Breaking news')
   end
 
   def subject


=====================================
plugins/solr/dependencies.rb
=====================================
--- a/plugins/solr/dependencies.rb
+++ b/plugins/solr/dependencies.rb
@@ -1,4 +1,3 @@
-require 'rubygems'
 require 'active_record'
 require "#{File.dirname(__FILE__)}/lib/acts_as_searchable"
 require "#{File.dirname(__FILE__)}/lib/acts_as_faceted"


=====================================
plugins/solr/install.rb
=====================================
--- a/plugins/solr/install.rb
+++ b/plugins/solr/install.rb
@@ -1,5 +1,4 @@
 #raise "Not ready yet. Some tests are failing."
-require 'rubygems'
 require 'rake'
 
 tasks_dir = File.join(File.dirname(__FILE__), 'vendor', 'plugins', 'acts_as_solr_reloaded', 'lib', 'tasks', '*.rake')


=====================================
plugins/solr/vendor/plugins/acts_as_solr_reloaded/Rakefile
=====================================
--- a/plugins/solr/vendor/plugins/acts_as_solr_reloaded/Rakefile
+++ b/plugins/solr/vendor/plugins/acts_as_solr_reloaded/Rakefile
@@ -1,4 +1,3 @@
-require 'rubygems'
 require 'rake'
 require 'rake/testtask'
 require 'rdoc/task'


=====================================
plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/acts_as_solr/tasks.rb
=====================================
--- a/plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/acts_as_solr/tasks.rb
+++ b/plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/acts_as_solr/tasks.rb
@@ -1,5 +1,4 @@
 dir = File.dirname(__FILE__)
-require 'rubygems'
 require 'rake'
 require 'net/http'
 require 'active_record'


=====================================
plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/solr/xml.rb
=====================================
--- a/plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/solr/xml.rb
+++ b/plugins/solr/vendor/plugins/acts_as_solr_reloaded/lib/solr/xml.rb
@@ -16,7 +16,6 @@ end
 begin
   
   # If we can load rubygems and libxml-ruby...
-  require 'rubygems'
   require 'xml/libxml'
   raise "acts_as_solr requires libxml-ruby 0.7 or greater" unless XML::Node.public_instance_methods.collect{|x| x.to_sym}.include?(:attributes)
 


=====================================
plugins/solr/vendor/plugins/acts_as_solr_reloaded/solr_test_rakefile.rb
=====================================
--- a/plugins/solr/vendor/plugins/acts_as_solr_reloaded/solr_test_rakefile.rb
+++ b/plugins/solr/vendor/plugins/acts_as_solr_reloaded/solr_test_rakefile.rb
@@ -1,4 +1,3 @@
-require 'rubygems'
 require 'rake'
 dir = File.dirname(__FILE__)
 $:.unshift("#{dir}/lib")


=====================================
plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/test_helper.rb
=====================================
--- a/plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/test_helper.rb
+++ b/plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/test_helper.rb
@@ -1,4 +1,3 @@
-require 'rubygems'
 require 'test/unit'
 require 'active_record'
 require 'active_record/fixtures'


=====================================
plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/unit/test_helper.rb
=====================================
--- a/plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/unit/test_helper.rb
+++ b/plugins/solr/vendor/plugins/acts_as_solr_reloaded/test/unit/test_helper.rb
@@ -1,7 +1,6 @@
 dir = File.dirname(__FILE__)
 $:.unshift(File.join(File.expand_path(dir), "..", "..", "lib"))
 
-require 'rubygems'
 require 'test/unit'
 require 'acts_as_solr'
 require 'mocha'


=====================================
plugins/spaminator/dependencies.rb
=====================================
--- a/plugins/spaminator/dependencies.rb
+++ b/plugins/spaminator/dependencies.rb
@@ -1,2 +1 @@
-require 'rubygems'
 require 'benchmark'


=====================================
public/designs/themes/base/style.css
=====================================
--- a/public/designs/themes/base/style.css
+++ b/public/designs/themes/base/style.css
@@ -480,6 +480,7 @@ div#notice {
 #content .profile-list-block ul,
 #content .enterprises-block ul,
 #content .communities-block ul,
+#content .favorite-enterprises-block ul,
 #content .fans-block ul {
   min-width: 196px;
   width: 192px;
@@ -495,15 +496,14 @@ div#notice {
   display: block;
 }
 
+.block-footer-content {
+  text-align: center;
+  padding-top: 3px;
+}
+
 .block-footer-content a.view-all {
-  position: absolute;
-  top: 2px;
-  right: 0px;
   font-size: 11px;
   color: #000;
-  text-decoration: none;
-  padding-right: 15px;
-  background: url(imgs/arrow-right-p.png) 100% 50% no-repeat;
 }
 
 #content .profile-list-block .block-title {


=====================================
public/stylesheets/application.css
=====================================
--- a/public/stylesheets/application.css
+++ b/public/stylesheets/application.css
@@ -3584,7 +3584,7 @@ table.cms-articles .icon:hover {
 }
 
 .controller-cms .show-media-panel .with_media_panel {
-  width: 600px;
+  width: 540px;
   transition: 1s;
 }
 
@@ -3656,7 +3656,7 @@ table.cms-articles .icon:hover {
 
 .text-editor-sidebar {
   position: absolute;
-  width: 280px;
+  width: 340px;
   right: 20px;
   top: 70px;
   max-height: 45px;
@@ -3720,7 +3720,7 @@ table.cms-articles .icon:hover {
 }
 
 .text-editor-sidebar .image {
-  width: 80px;
+  width: 100px;
   margin: 2px;
   height: 80px;
   line-height: 80px;


=====================================
script/vagrant
=====================================
--- a/script/vagrant
+++ b/script/vagrant
@@ -12,5 +12,13 @@ for ip in 10.0.2.2 192.168.122.1; do
   fi
 done
 
+sudo apt-get install -qy postfix
+sudo postconf virtual_alias_maps=hash:/etc/postfix/virtual
+sudo tee /etc/postfix/virtual <<EOF
+ at localhost.localdomain  vagrant
+EOF
+sudo postmap /etc/postfix/virtual
+sudo service postfix reload
+
 cd /vagrant
 ./script/quick-start


=====================================
test/functional/profile_editor_controller_test.rb
=====================================
--- a/test/functional/profile_editor_controller_test.rb
+++ b/test/functional/profile_editor_controller_test.rb
@@ -1152,4 +1152,10 @@ class ProfileEditorControllerTest < ActionController::TestCase
     get :index, :profile => user.identifier
     assert_tag :tag => 'div', :descendant => { :tag => 'a', :content => 'Edit Header and Footer' }
   end
+
+  should 'not display button to manage roles on control panel of person' do
+    get :index, :profile => profile.identifier
+    assert_no_tag :tag => 'a', :attributes => { :href => "/myprofile/default_user/profile_roles" }
+  end
+
 end


=====================================
test/unit/article_test.rb
=====================================
--- a/test/unit/article_test.rb
+++ b/test/unit/article_test.rb
@@ -930,14 +930,6 @@ class ArticleTest < ActiveSupport::TestCase
     assert_no_match(/<script>/, a.name)
   end
 
-  should 'escape malformed html tags' do
-    article = Article.new
-    article.name = "<h1 Malformed >> html >< tag"
-    article.valid?
-
-    assert_no_match /[<>]/, article.name
-  end
-
   should 'return truncated title in short_title' do
     article = Article.new
     article.name = 'a123456789abcdefghij'


=====================================
test/unit/comment_test.rb
=====================================
--- a/test/unit/comment_test.rb
+++ b/test/unit/comment_test.rb
@@ -201,17 +201,6 @@ class CommentTest < ActiveSupport::TestCase
     assert comment.errors[:body.to_s].present?
   end
 
-  should 'escape malformed html tags' do
-    owner = create_user('testuser').person
-    article = owner.articles.create(:name => 'test', :body => '...')
-    comment = build(Comment, :article => article, :title => '<h1 title </h1>>> sd f <<', :body => '<h1>> sdf><asd>< body </h1>', :name => '<h1 name </h1>>><<dfsf<sd', :email => 'cracker at test.org')
-    comment.valid?
-
-    assert_no_match /[<>]/, comment.title
-    assert_no_match /[<>]/, comment.body
-    assert_no_match /[<>]/, comment.name
-  end
-
   should 'use an existing image for deleted comments' do
     image = Comment.new.removed_user_image[1..-1]
     assert File.exists?(Rails.root.join('public', image)), "#{image} does not exist."
@@ -749,6 +738,18 @@ class CommentTest < ActiveSupport::TestCase
     comment.destroy
   end
 
+  should 'not double escape html content after validation' do
+    comment = create_comment
+    body = 'Comment with "quotes"'
+    comment.body = body
+
+    comment.valid?
+    assert_equal body, comment.body
+
+    comment.valid?
+    assert_equal body, comment.body
+  end
+
   private
 
   def create_comment(args = {})


=====================================
test/unit/community_test.rb
=====================================
--- a/test/unit/community_test.rb
+++ b/test/unit/community_test.rb
@@ -242,20 +242,6 @@ class CommunityTest < ActiveSupport::TestCase
     end
   end
 
-  should 'escape malformed html tags' do
-    community = Community.new
-    community.name = "<h1 Malformed >> html >< tag"
-    community.address = "<h1 Malformed >,<<<asfdf> html >< tag"
-    community.contact_phone = "<h1 Malformed<<> >> html >><>< tag"
-    community.description = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    community.valid?
-
-    assert_no_match /[<>]/, community.name
-    assert_no_match /[<>]/, community.address
-    assert_no_match /[<>]/, community.contact_phone
-    assert_no_match /[<>]/, community.description
-  end
-
   should "the followed_by method be protected and true to the community members by default" do
     c = fast_create(Community)
     p1 = fast_create(Person)


=====================================
test/unit/environment_test.rb
=====================================
--- a/test/unit/environment_test.rb
+++ b/test/unit/environment_test.rb
@@ -1140,14 +1140,6 @@ class EnvironmentTest < ActiveSupport::TestCase
     assert_equal "<h1> Disabled Enterprise </h1>", environment.message_for_disabled_enterprise
   end
 
-  should 'escape malformed html tags' do
-    environment = Environment.new
-    environment.message_for_disabled_enterprise = "<h1> Disabled Enterprise /h1>"
-    environment.valid?
-
-    assert_no_match /[<>]/, environment.message_for_disabled_enterprise
-  end
-
   should 'not sanitize html comments' do
     environment = Environment.new
     environment.message_for_disabled_enterprise = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'


=====================================
test/unit/event_test.rb
=====================================
--- a/test/unit/event_test.rb
+++ b/test/unit/event_test.rb
@@ -274,24 +274,6 @@ class EventTest < ActiveSupport::TestCase
     assert_not_includes profile.events.by_day(today), event_out_of_range
   end
 
-  should 'filter fields with full filter' do
-    event = Event.new
-    event.link = "<h1 Malformed >> html >< tag"
-    event.valid?
-
-    assert_no_match /[<>]/, event.link
-  end
-
-  should 'filter fields with white_list filter' do
-    event = Event.new
-    event.body = "<h1> Description </h1>"
-    event.address = "<strong> Address <strong>"
-    event.valid?
-
-    assert_equal "<h1> Description </h1>", event.body
-    assert_equal "<strong> Address <strong>", event.address
-  end
-
   should 'not filter & on link field' do
     event = Event.new
     event.link = 'myevent.com/?param1=value&param2=value2'
@@ -300,16 +282,6 @@ class EventTest < ActiveSupport::TestCase
     assert_equal "http://myevent.com/?param1=value&param2=value2", event.link
   end
 
-  should 'escape malformed html tags' do
-    event = Event.new
-    event.body = "<h1<< Description >>/h1>"
-    event.address = "<strong>><< Address <strong>"
-    event.valid?
-
-    assert_no_match /[<>]/, event.body
-    assert_no_match /[<>]/, event.address
-  end
-
   should 'not sanitize html comments' do
     event = Event.new
     event.body = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'


=====================================
test/unit/folder_test.rb
=====================================
--- a/test/unit/folder_test.rb
+++ b/test/unit/folder_test.rb
@@ -132,14 +132,6 @@ class FolderTest < ActiveSupport::TestCase
     assert_match  /<!-- .* --> <h1> Wellformed html code <\/h1>/, folder.body
   end
 
-  should 'escape malformed html tags' do
-    folder = Folder.new
-    folder.body = "<h1<< Description >>/h1>"
-    folder.valid?
-
-    assert_no_match /[<>]/, folder.body
-  end
-
   should 'not have a blog as parent' do
     folder = Folder.new
     folder.parent = Blog.new


=====================================
test/unit/gallery_test.rb
=====================================
--- a/test/unit/gallery_test.rb
+++ b/test/unit/gallery_test.rb
@@ -133,14 +133,6 @@ class GalleryTest < ActiveSupport::TestCase
     assert_match  /<!-- .* --> <h1> Wellformed html code <\/h1>/, gallery.body
   end
 
-  should 'escape malformed html tags' do
-    gallery = Gallery.new
-    gallery.body = "<h1<< Description >>/h1>"
-    gallery.valid?
-
-    assert_no_match /[<>]/, gallery.body
-  end
-
   should 'accept uploads' do
     folder = fast_create(Gallery)
     assert folder.accept_uploads?


=====================================
test/unit/highlights_block_test.rb
=====================================
--- a/test/unit/highlights_block_test.rb
+++ b/test/unit/highlights_block_test.rb
@@ -132,6 +132,32 @@ class HighlightsBlockTest < ActiveSupport::TestCase
     assert_equal block.images.first[:address], "/social/address"
   end
 
+  should 'not duplicate sub-dir address before save' do
+    Noosfero.stubs(:root).returns("/social")
+    f1 = mock()
+    f1.expects(:public_filename).returns('address')
+    UploadedFile.expects(:find).with(1).returns(f1)
+    block = HighlightsBlock.new
+    i1 = {:image_id => 1, :address => '/social/address', :position => 3, :title => 'address'}
+    block.images = [i1]
+    block.save!
+    block.reload
+    assert_equal block.images.first[:address], "/social/address"
+  end
+
+  should 'display images with subdir src' do
+    Noosfero.stubs(:root).returns("/social")
+    f1 = mock()
+    f1.expects(:public_filename).returns('/img_address')
+    UploadedFile.expects(:find).with(1).returns(f1)
+    block = HighlightsBlock.new
+    i1 = {:image_id => 1, :address => '/address'}
+    block.images = [i1]
+    block.save!
+
+    assert_tag_in_string instance_eval(& block.content), :tag => 'img', :attributes => { :src => "/social/img_address" }
+  end
+
   [Environment, Profile].each do |klass|
     should "choose between owner galleries when owner is #{klass.name}" do
       owner = fast_create(klass)


=====================================
test/unit/organization_test.rb
=====================================
--- a/test/unit/organization_test.rb
+++ b/test/unit/organization_test.rb
@@ -253,25 +253,6 @@ class OrganizationTest < ActiveSupport::TestCase
     assert organization.closed
   end
 
-  should 'escape malformed html tags' do
-    organization = Organization.new
-    organization.acronym = "<h1 Malformed >> html >< tag"
-    organization.contact_person = "<h1 Malformed >,<<<asfdf> html >< tag"
-    organization.contact_email = "<h1<malformed at html.com>>"
-    organization.description = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.legal_form = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.economic_activity = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.management_information = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.valid?
-
-    assert_no_match /[<>]/, organization.acronym
-    assert_no_match /[<>]/, organization.contact_person
-    assert_no_match /[<>]/, organization.contact_email
-    assert_no_match /[<>]/, organization.legal_form
-    assert_no_match /[<>]/, organization.economic_activity
-    assert_no_match /[<>]/, organization.management_information
-  end
-
   should "the followed_by? be true only to members" do
     o = fast_create(Organization)
     p1 = fast_create(Person)


=====================================
test/unit/product_test.rb
=====================================
--- a/test/unit/product_test.rb
+++ b/test/unit/product_test.rb
@@ -171,16 +171,6 @@ class ProductTest < ActiveSupport::TestCase
     assert_equal @product_category.name, product.name
   end
 
-  should 'escape malformed html tags' do
-    product = build(Product, :product_category => @product_category)
-    product.name = "<h1 Malformed >> html >< tag"
-    product.description = "<h1 Malformed</h1>><<<a>> >> html >< tag"
-    product.valid?
-
-    assert_no_match /[<>]/, product.name
-    assert_no_match /[<>]/, product.description
-  end
-
   should 'use name of category when has no name yet' do
     product = Product.new
     product.product_category = @product_category


=====================================
test/unit/profile_test.rb
=====================================
--- a/test/unit/profile_test.rb
+++ b/test/unit/profile_test.rb
@@ -1696,34 +1696,6 @@ class ProfileTest < ActiveSupport::TestCase
     assert_equal "<strong> Custom Footer <strong>", profile.custom_footer
   end
 
-  should 'escape malformed html tags' do
-    profile = Profile.new
-    profile.name = "<h1 Malformed >> html >>></a>< tag"
-    profile.nickname = "<h1 Malformed <<h1>>< html >< tag"
-    profile.address = "<h1><</h2< Malformed >> html >< tag"
-    profile.contact_phone = "<h1<< Malformed ><>>> html >< tag"
-    profile.description = "<h1<a> Malformed >> html ></a>< tag"
-    profile.valid?
-
-    assert_no_match /[<>]/, profile.name
-    assert_no_match /[<>]/, profile.nickname
-    assert_no_match /[<>]/, profile.address
-    assert_no_match /[<>]/, profile.contact_phone
-    assert_no_match /[<>]/, profile.description
-    assert_no_match /[<>]/, profile.custom_header
-    assert_no_match /[<>]/, profile.custom_footer
-  end
-
-  should 'escape malformed html tags in header and footer' do
-    profile = fast_create(Profile)
-    profile.custom_header = "<h1<a>><<> Malformed >> html ></a>< tag"
-    profile.custom_footer = "<h1> Malformed <><< html ></a>< tag"
-    profile.save
-
-    assert_no_match /[<>]/, profile.custom_header
-    assert_no_match /[<>]/, profile.custom_footer
-  end
-
   should 'not sanitize html comments' do
     profile = Profile.new
     profile.custom_header = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'


=====================================
test/unit/text_article_test.rb
=====================================
--- a/test/unit/text_article_test.rb
+++ b/test/unit/text_article_test.rb
@@ -14,15 +14,6 @@ class TextArticleTest < ActiveSupport::TestCase
     assert_includes TextArticle.find(:all), article
   end
 
-  should 'remove HTML from name' do
-    person = create_user('testuser').person
-    article = TextArticle.new(:profile => person)
-    article.name = "<h1 Malformed >> html >>></a>< tag"
-    article.valid?
-
-    assert_no_match /[<>]/, article.name
-  end
-
   should 'be translatable' do
     assert_kind_of Noosfero::TranslatableContent, TextArticle.new
   end


=====================================
test/unit/validation_info_test.rb
=====================================
--- a/test/unit/validation_info_test.rb
+++ b/test/unit/validation_info_test.rb
@@ -21,14 +21,4 @@ class ValidationInfoTest < ActiveSupport::TestCase
     end
   end
 
-  should 'escape malformed html tags' do
-    info = ValidationInfo.new
-    info.validation_methodology = "<h1 Malformed >> html >< tag"
-    info.restrictions = "<h1 Malformed >> html >< tag"
-    info.valid?
-
-    assert_no_match /[<>]/, info.validation_methodology
-    assert_no_match /[<>]/, info.restrictions
-  end
-
 end


=====================================
vendor/plugins/xss_terminate/lib/xss_terminate.rb
=====================================
--- a/vendor/plugins/xss_terminate/lib/xss_terminate.rb
+++ b/vendor/plugins/xss_terminate/lib/xss_terminate.rb
@@ -38,7 +38,7 @@ module XssTerminate
 
   module InstanceMethods
 
-    def sanitize_field(sanitizer, field, serialized = false, with= :full)
+    def sanitize_field(sanitizer, field, serialized = false)
       field = field.to_sym
       if serialized
         puts field
@@ -49,25 +49,11 @@ module XssTerminate
       else
         if self[field]
           self[field] = sanitizer.sanitize(self[field])
-
-          if with == :full
-            self[field] = CGI.escapeHTML(self[field])
-          elsif with == :white_list
-            self[field] = CGI.escapeHTML(self[field]) if !wellformed_html_code?(self[field])
-          end
-
         else
           value = self.send("#{field}")
           return unless value
           value = sanitizer.sanitize(value)
           self.send("#{field}=", value)
-
-          if with == :full
-            self.send("#{field}=", CGI.escapeHTML(value))
-          elsif with == :white_list
-            self.send("#{field}=", CGI.escapeHTML(value)) if !wellformed_html_code?(value)
-          end
-
         end
       end
     end
@@ -86,7 +72,7 @@ module XssTerminate
       sanitizer = ActionView::Base.full_sanitizer
       columns, columns_serialized = sanitize_columns(:full)
       columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column), :full)
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
     end
 
@@ -94,7 +80,7 @@ module XssTerminate
       sanitizer = ActionView::Base.white_list_sanitizer
       columns, columns_serialized = sanitize_columns(:white_list)
       columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column), :white_list)
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
    end
 
@@ -102,38 +88,8 @@ module XssTerminate
       sanitizer = HTML5libSanitize.new
       columns = sanitize_columns(:html5lib)
       columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column), :html5lib)
-      end
-    end
-
-    def wellformed_html_code?(field)
-      return true if !field
-      counter = 0
-      in_comment = false
-      field=field.split(//)
-      for i in 0..field.length-1
-        if !in_comment
-          if field[i] == '<'
-            if field[i+1..i+3] == ["!","-","-"]
-              in_comment = true
-            else
-              counter += 1
-            end
-          elsif field[i] == '>'
-            counter -= 1
-          end
-        else
-          if field[i-2..i] == ["-","-",">"]
-            in_comment = false
-          end
-        end
-
-        if counter < 0 || 1 < counter
-          return false
-        end
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
-
-      return counter == 0
     end
 
   end



View it on GitLab: https://gitlab.com/noosfero/noosfero/compare/6dc56436db7a51aa488b1b893fd47ac7974d2e35...8dc25e9107ddf8096c8d1fdb938cf463b7d33ee0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listas.softwarelivre.org/pipermail/noosfero-dev/attachments/20151013/37c90d81/attachment-0001.html>


More information about the Noosfero-dev mailing list