intercom-rails 0.2.13 → 0.2.14

data/lib/intercom-rails/import.rb

@@ -37,7 +37,7 @@ module IntercomRails
       raise ImportError, "You can only import your users from your production environment" unless Rails.env.production?
       raise ImportError, "We couldn't find your user class, please set one in config/initializers/intercom_rails.rb" unless user_klass.present?
       info "Found user class: #{user_klass}"
-      raise ImportError, "Only ActiveRecord models are supported" unless (user_klass < ActiveRecord::Base)
+      raise ImportError, "Only ActiveRecord models are supported" unless defined?(ActiveRecord::Base) && (user_klass < ActiveRecord::Base)
       raise ImportError, "Please add an Intercom API Key to config/initializers/intercom.rb" unless IntercomRails.config.api_key.present?
       info "Intercom API key found"
     end

data/lib/intercom-rails/script_tag.rb

@@ -1,5 +1,6 @@
-require "active_support/json"
-require "active_support/core_ext/hash/indifferent_access"
+require 'active_support/json'
+require 'active_support/core_ext/hash/indifferent_access'
+require 'active_support/core_ext/string/output_safety'
 
 module IntercomRails
 
@@ -36,9 +37,11 @@ module IntercomRails
     end
 
     def output
+      intercom_settings_json = ActiveSupport::JSON.encode(intercom_settings).gsub('<', '\u003C')
+
       str = <<-INTERCOM_SCRIPT
 <script id="IntercomSettingsScriptTag">
-  window.intercomSettings = #{ActiveSupport::JSON.encode(intercom_settings)};
+  window.intercomSettings = #{intercom_settings_json};
 </script>
 <script>(function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',intercomSettings);}else{var d=document;var i=function(){i.c(arguments)};i.q=[];i.c=function(args){i.q.push(args)};w.Intercom=i;function l(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='#{Config.library_url || 'https://api.intercom.io/api/js/library.js'}';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s,x);}if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}};})()</script>
       INTERCOM_SCRIPT

data/lib/intercom-rails/version.rb

@@ -1,3 +1,3 @@
 module IntercomRails
-  VERSION = "0.2.13"
+  VERSION = "0.2.14"
 end

data/lib/rails/generators/intercom/config/intercom.rb.erb

@@ -4,7 +4,7 @@ IntercomRails.config do |config|
   config.app_id = ENV["INTERCOM_APP_ID"] || "<%= @app_id %>"
 
   # == Intercom secret key 
-  # This is reuqired to enable secure mode, you can find it on your Intercom 
+  # This is required to enable secure mode, you can find it on your Intercom 
   # "security" configuration page.
   # 
   <%- if @api_secret -%>

data/test/intercom-rails/script_tag_test.rb

@@ -102,4 +102,10 @@ class ScriptTagTest < MiniTest::Unit::TestCase
     assert_equal expected_company, script_tag.intercom_settings[:company]
   end
 
+  def test_escapes_html_attributes
+    nasty_email = "</script><script>alert('sup?');</script>"
+    script_tag = ScriptTag.new(:user_details => {:email => nasty_email})
+    assert !script_tag.output.include?(nasty_email), "script tag included"
+  end
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: intercom-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.13
+  version: 0.2.14
   prerelease: 
 platform: ruby
 authors:
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-01-15 00:00:00.000000000 Z
+date: 2013-02-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -180,7 +180,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1447193965659527356
+      hash: 672914866495773286
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -189,7 +189,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1447193965659527356
+      hash: 672914866495773286
 requirements: []
 rubyforge_project: intercom-rails
 rubygems_version: 1.8.23