TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-12-25 11:55:03 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #2686 from iBotPeaches/unsafe_meta

Browse Source 
escapes " in meta title/description
This commit is contained in:
Hannah Wolfe 2014-05-31 17:48:29 +01:00
commit 99c96abab3
2 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/server/helpers/index.js
View File

@ -497,7 +497,7 @@ coreHelpers.meta_title = function (options) {
return filters.doFilter('meta_title', title).then(function (title) { return filters.doFilter('meta_title', title).then(function (title) {
title = title || ""; title = title || "";
return new hbs.handlebars.SafeString(title.trim()); return title.trim();
}); });
}; };
@ -517,7 +517,7 @@ coreHelpers.meta_description = function (options) {
return filters.doFilter('meta_description', description).then(function (description) { return filters.doFilter('meta_description', description).then(function (description) {
description = description || ""; description = description || "";
return new hbs.handlebars.SafeString(description.trim()); return description.trim();
}); });
}; };

22
core/test/unit/server_helpers_index_spec.js
View File

@ -900,7 +900,7 @@ describe('Core Helpers', function () {
it('can return blog title', function (done) { it('can return blog title', function (done) {
helpers.meta_title.call({relativeUrl: '/'}).then(function (rendered) { helpers.meta_title.call({relativeUrl: '/'}).then(function (rendered) {
should.exist(rendered); should.exist(rendered);
rendered.string.should.equal('Ghost'); String(rendered).should.equal('Ghost');
done(); done();
}).catch(done); }).catch(done);
@ -910,7 +910,17 @@ describe('Core Helpers', function () {
var post = {relativeUrl: '/nice-post', post: {title: 'Post Title'}}; var post = {relativeUrl: '/nice-post', post: {title: 'Post Title'}};
helpers.meta_title.call(post).then(function (rendered) { helpers.meta_title.call(post).then(function (rendered) {
should.exist(rendered); should.exist(rendered);
rendered.string.should.equal('Post Title'); String(rendered).should.equal('Post Title');
done();
}).then(null, done);
});
it('can return escaped title of a post', function (done) {
var post = {relativeUrl: '/nice-escaped-post', post: {title: 'Post Title "</>'}};
helpers.meta_title.call(post).then(function (rendered) {
should.exist(rendered);
String(rendered).should.equal('Post Title "</>');
done(); done();
}).catch(done); }).catch(done);
@ -920,7 +930,7 @@ describe('Core Helpers', function () {
var post = {relativeUrl: '/tag/foo', tag: {name: 'foo'}}; var post = {relativeUrl: '/tag/foo', tag: {name: 'foo'}};
helpers.meta_title.call(post).then(function (rendered) { helpers.meta_title.call(post).then(function (rendered) {
should.exist(rendered); should.exist(rendered);
rendered.string.should.equal('foo - Ghost'); String(rendered).should.equal('foo - Ghost');
done(); done();
}).catch(done); }).catch(done);
@ -936,17 +946,17 @@ describe('Core Helpers', function () {
it('can return blog description', function (done) { it('can return blog description', function (done) {
helpers.meta_description.call({relativeUrl: '/'}).then(function (rendered) { helpers.meta_description.call({relativeUrl: '/'}).then(function (rendered) {
should.exist(rendered); should.exist(rendered);
rendered.string.should.equal('Just a blogging platform.'); String(rendered).should.equal('Just a blogging platform.');
done(); done();
}).catch(done); }).catch(done);
}); });
it('can return empty description on post', function (done) { it('can return empty description on post', function (done) {
var post = {relativeUrl: '/nice-post', post: {title: 'Post Title'}}; var post = {relativeUrl: '/nice-post', post: {title: 'Post Title'}};
helpers.meta_description.call(post).then(function (rendered) { helpers.meta_description.call(post).then(function (rendered) {
should.exist(rendered); should.exist(rendered);
rendered.string.should.equal(''); String(rendered).should.equal('');
done(); done();
}).catch(done); }).catch(done);