muck-comments 0.1.16 → 0.1.17

data/Rakefile

@@ -54,6 +54,8 @@ begin
     gemspec.description = "The comment engine for the muck system."
     gemspec.authors = ["Justin Ball", "Joel Duffin"]
     gemspec.rubyforge_project = 'muck-comments'
+    gemspec.add_dependency "sanitize"
+    gemspec.add_dependency "awesome_nested_set"
     gemspec.add_dependency "muck-engine"
     gemspec.add_dependency "muck-users"
   end

data/VERSION

@@ -1 +1 @@
-0.1.16
+0.1.17

data/app/views/comments/_comment.html.erb

@@ -1,7 +1,7 @@
 <div id="<%= comment.dom_id %>" class="comment_holder delete-container">
   <div class="commentor-icon"><%= icon comment.user %></div>
   <p><span class="commentor"><%= link_to comment.user.try(:display_name), comment.user %></span>
-    <%= h limit_comment(comment.body, truncate_comment, length, omission) %></p>
+    <%= limit_comment(comment.body, truncate_comment, length, omission) %></p>
   <%= delete_comment(comment, :image) if comment.can_edit?(current_user) %>
   <span class="comment-time"><%= t("muck.general.time_ago", :time_in_words => time_ago_in_words(comment.created_at)) %></span></p>
 </div>

data/app/views/comments/_comment_title.html.erb

@@ -1,5 +1,3 @@
-<% c = comment_title.comment.dup.gsub(/\[youtube:+.+\]/, '') %>
-
 <div id="<%= comment_title.dom_id %>" class="comment_holder">
   <%= icon comment_title.user, :small, :class => 'left avatar_on_comment' %> 
 	<div class="date_details">
@@ -8,7 +6,7 @@
 																														 										profile_path(comment_title.user))} %> 
 	</div>
 	<div class="comment_message">
-      <%= sanitize(textilize(c)) %>
+      <%= comment_title.body %>
   </div>
   <div class="clear"></div>
 </div>

data/app/views/comments/_simple_comment.html.erb

@@ -1,4 +1,4 @@
 <div id="<%= simple_comment.dom_id %>" class="simple-comment">
   <div class="commentor-icon"><%= icon simple_comment.user %></div>
-  <div class="comment-body"><%= h limit_comment(simple_comment.body, truncate_comment, length, omission) %></div>
+  <div class="comment-body"><%= limit_comment(simple_comment.body, truncate_comment, length, omission) %></div>
 </div>

data/lib/active_record/acts/muck_comment.rb

@@ -9,6 +9,11 @@ module ActiveRecord
 
         def acts_as_muck_comment(options = {})
 
+          default_options = { 
+            :sanitize_content => true,
+          }
+          options = default_options.merge(options)
+          
           acts_as_nested_set :scope => [:commentable_id, :commentable_type]
           validates_presence_of :body
           belongs_to :user
@@ -18,7 +23,11 @@ module ActiveRecord
           named_scope :by_newest, :order => "created_at DESC"
           named_scope :by_oldest, :order => "created_at ASC"
           named_scope :recent, lambda { { :conditions => ['created_at > ?', 1.week.ago] } }
-                            
+          
+          if options[:sanitize_content]
+            before_save :sanitize_attributes
+          end
+
           class_eval <<-EOV
             # prevents a user from submitting a crafted form that bypasses activation
             attr_protected :created_at, :updated_at
@@ -78,6 +87,34 @@ module ActiveRecord
           false
         end
 
+        # Sanitize content before saving.  This prevent XSS attacks and other malicious html.
+        def sanitize_attributes
+          if self.sanitize_level
+            self.body = Sanitize.clean(self.body, self.sanitize_level)
+          end
+        end
+        
+        # Override this method to control sanitization levels.
+        # Currently a user who is an admin will not have their content sanitized.  A user
+        # in any role 'editor', 'manager', or 'contributor' will be given the 'RELAXED' settings
+        # while all other users will get 'BASIC'.
+        #
+        # By default the 'creator' of the content will be used to determine which level of
+        # sanitization is allowed.  To change this set 'current_editor' before
+        #
+        # Options are from sanitze:
+        # nil - no sanitize
+        # Sanitize::Config::RELAXED
+        # Sanitize::Config::BASIC
+        # Sanitize::Config::RESTRICTED
+        # for more details see: http://rgrove.github.com/sanitize/
+        def sanitize_level
+          return Sanitize::Config::BASIC if self.user.nil?
+          return nil if self.user.admin?
+          return Sanitize::Config::RELAXED if self.user.any_role?('editor', 'manager', 'contributor')
+          Sanitize::Config::BASIC
+        end
+        
       end
     end
   end

data/muck-comments.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = %q{muck-comments}
-  s.version = "0.1.16"
+  s.version = "0.1.17"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Justin Ball", "Joel Duffin"]
@@ -415,13 +415,19 @@ Gem::Specification.new do |s|
     s.specification_version = 3
 
     if Gem::Version.new(Gem::RubyGemsVersion) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<sanitize>, [">= 0"])
+      s.add_runtime_dependency(%q<awesome_nested_set>, [">= 0"])
       s.add_runtime_dependency(%q<muck-engine>, [">= 0"])
       s.add_runtime_dependency(%q<muck-users>, [">= 0"])
     else
+      s.add_dependency(%q<sanitize>, [">= 0"])
+      s.add_dependency(%q<awesome_nested_set>, [">= 0"])
       s.add_dependency(%q<muck-engine>, [">= 0"])
       s.add_dependency(%q<muck-users>, [">= 0"])
     end
   else
+    s.add_dependency(%q<sanitize>, [">= 0"])
+    s.add_dependency(%q<awesome_nested_set>, [">= 0"])
     s.add_dependency(%q<muck-engine>, [">= 0"])
     s.add_dependency(%q<muck-users>, [">= 0"])
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: muck-comments
 version: !ruby/object:Gem::Version 
-  version: 0.1.16
+  version: 0.1.17
 platform: ruby
 authors: 
 - Justin Ball
@@ -13,6 +13,26 @@ cert_chain: []
 date: 2009-12-02 00:00:00 -07:00
 default_executable: 
 dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: sanitize
+  type: :runtime
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+    version: 
+- !ruby/object:Gem::Dependency 
+  name: awesome_nested_set
+  type: :runtime
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+    version: 
 - !ruby/object:Gem::Dependency 
   name: muck-engine
   type: :runtime