#228: escape commit changes as it might be html also

dgroup · Oct 3, 2020 · 00db060 · 00db060
1 parent e179ea0
commit 00db060
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/lib/messages/svn_log.erb b/lib/messages/svn_log.erb
@@ -97,13 +97,13 @@
         </p>
       <% else %>
         <% if line.start_with?("+++") || line.start_with?("---") %>
-          <p style="background: gainsboro;"><%= line.gsub("<", "&lt;") %></p>
+          <p style="background: gainsboro;"><%= line.gsub(/[<>]/, '<' => '&lt;', '>' => '&gt;') %></p>
         <% elsif line.start_with?("+") %>
-          <p style="<%= "background: darkseagreen;" %>"><%= line.gsub("<", "&lt;") %></p>
+          <p style="<%= "background: darkseagreen;" %>"><%= line.gsub(/[<>]/, '<' => '&lt;', '>' => '&gt;') %></p>
         <% elsif line.start_with?("-") %>
-          <p style="<%= "background: lightsalmon;" %>"><%= line.gsub("<", "&lt;") %></p>
+          <p style="<%= "background: lightsalmon;" %>"><%= line.gsub(/[<>]/, '<' => '&lt;', '>' => '&gt;') %></p>
         <% else %>
-          <p style="background: gainsboro;"><%= line %></p>
+          <p style="background: gainsboro;"><%= line.gsub(/[<>]/,'<' => '&lt;', '>' => '&gt;') %></p>
         <% end %>
       <% end %>
     <% end %>