OSDN Git Service

Prevent xss attack over group name. Added regex validation for group and team name
[wvm/gitlab.git] / app / helpers / application_helper.rb
index 8c65a0f..d02130c 100644 (file)
@@ -1,4 +1,5 @@
 require 'digest/md5'
+require 'uri'
 
 module ApplicationHelper
 
@@ -30,27 +31,21 @@ module ApplicationHelper
     args.any? { |v| v.to_s.downcase == action_name }
   end
 
-  def gravatar_icon(user_email = '', size = 40)
-    if Gitlab.config.disable_gravatar? || user_email.blank?
+  def gravatar_icon(user_email = '', size = nil)
+    size = 40 if size.nil? || size <= 0
+
+    if !Gitlab.config.gravatar.enabled || user_email.blank?
       'no_avatar.png'
     else
-      gravatar_prefix = request.ssl? ? "https://secure" : "http://www"
+      gravatar_url = request.ssl? ? Gitlab.config.gravatar.ssl_url : Gitlab.config.gravatar.plain_url
       user_email.strip!
-      "#{gravatar_prefix}.gravatar.com/avatar/#{Digest::MD5.hexdigest(user_email.downcase)}?s=#{size}&d=identicon"
+      sprintf gravatar_url, hash: Digest::MD5.hexdigest(user_email.downcase), size: size
     end
   end
 
-  def request_protocol
-    request.ssl? ? "https" : "http"
-  end
-
-  def web_app_url
-    "#{request_protocol}://#{Gitlab.config.web_host}/"
-  end
-
   def last_commit(project)
     if project.repo_exists?
-      time_ago_in_words(project.commit.committed_date) + " ago"
+      time_ago_in_words(project.repository.commit.committed_date) + " ago"
     else
       "Never"
     end
@@ -59,9 +54,11 @@ module ApplicationHelper
   end
 
   def grouped_options_refs(destination = :tree)
+    repository = @project.repository
+
     options = [
-      ["Branch", @project.branch_names ],
-      [ "Tag", @project.tag_names ]
+      ["Branch", repository.branch_names ],
+      [ "Tag", repository.tag_names ]
     ]
 
     # If reference is commit id -
@@ -75,33 +72,51 @@ module ApplicationHelper
   end
 
   def search_autocomplete_source
-    projects = current_user.projects.map{ |p| { label: p.name, url: project_path(p) } }
+    projects = current_user.authorized_projects.map { |p| { label: "project: #{p.name_with_namespace}", url: project_path(p) } }
+    groups = current_user.authorized_groups.map { |group| { label: "group: #{simple_sanitize(group.name)}", url: group_path(group) } }
+    teams = current_user.authorized_teams.map { |team| { label: "team: #{simple_sanitize(team.name)}", url: team_path(team) } }
+
     default_nav = [
-      { label: "Profile", url: profile_path },
-      { label: "Keys", url: keys_path },
-      { label: "Dashboard", url: root_path },
-      { label: "Admin", url: admin_root_path }
+      { label: "My Profile", url: profile_path },
+      { label: "My SSH Keys", url: keys_path },
+      { label: "My Dashboard", url: root_path },
+      { label: "Admin Section", url: admin_root_path },
     ]
 
-    project_nav = []
+    help_nav = [
+      { label: "help: API Help", url: help_api_path },
+      { label: "help: Markdown Help", url: help_markdown_path },
+      { label: "help: Permissions Help", url: help_permissions_path },
+      { label: "help: Public Access Help", url: help_public_access_path },
+      { label: "help: Rake Tasks Help", url: help_raketasks_path },
+      { label: "help: SSH Keys Help", url: help_ssh_path },
+      { label: "help: System Hooks Help", url: help_system_hooks_path },
+      { label: "help: Web Hooks Help", url: help_web_hooks_path },
+      { label: "help: Workflow Help", url: help_workflow_path },
+    ]
 
-    if @project && !@project.new_record?
+    project_nav = []
+    if @project && @project.repository && @project.repository.root_ref
       project_nav = [
-        { label: "#{@project.name} / Issues",  url: project_issues_path(@project) },
-        { label: "#{@project.name} / Wall",    url: wall_project_path(@project) },
-        { label: "#{@project.name} / Tree",    url: project_tree_path(@project, @ref || @project.root_ref) },
-        { label: "#{@project.name} / Commits", url: project_commits_path(@project, @ref || @project.root_ref) },
-        { label: "#{@project.name} / Team",    url: project_team_index_path(@project) }
+        { label: "#{@project.name_with_namespace} - Issues",   url: project_issues_path(@project) },
+        { label: "#{@project.name_with_namespace} - Commits",  url: project_commits_path(@project, @ref || @project.repository.root_ref) },
+        { label: "#{@project.name_with_namespace} - Merge Requests", url: project_merge_requests_path(@project) },
+        { label: "#{@project.name_with_namespace} - Milestones", url: project_milestones_path(@project) },
+        { label: "#{@project.name_with_namespace} - Snippets", url: project_snippets_path(@project) },
+        { label: "#{@project.name_with_namespace} - Team",     url: project_team_index_path(@project) },
+        { label: "#{@project.name_with_namespace} - Tree",     url: project_tree_path(@project, @ref || @project.repository.root_ref) },
+        { label: "#{@project.name_with_namespace} - Wall",     url: wall_project_path(@project) },
+        { label: "#{@project.name_with_namespace} - Wiki",     url: project_wikis_path(@project) },
       ]
     end
 
-    [projects, default_nav, project_nav].flatten.to_json
+    [groups, projects, default_nav, project_nav, help_nav].flatten.to_json
   end
 
   def emoji_autocomplete_source
     # should be an array of strings
     # so to_s can be called, because it is sufficient and to_json is too slow
-    Emoji::NAMES.to_s
+    Emoji.names.to_s
   end
 
   def ldap_enable?
@@ -112,11 +127,16 @@ module ApplicationHelper
     Gitlab::Theme.css_class_by_id(current_user.try(:theme_id))
   end
 
+  def user_color_scheme_class
+    current_user.dark_scheme ? :black : :white
+  end
+
   def show_last_push_widget?(event)
     event &&
       event.last_push_to_non_root? &&
       !event.rm_ref? &&
       event.project &&
+      event.project.repository &&
       event.project.merge_requests_enabled
   end
 
@@ -138,4 +158,14 @@ module ApplicationHelper
     image_tag("authbuttons/#{file_name}",
               alt: "Sign in with #{provider.to_s.titleize}")
   end
+
+  def simple_sanitize str
+    sanitize(str, tags: %w(a span))
+  end
+
+  def image_url(source)
+    root_url + path_to_image(source)
+  end
+
+  alias_method :url_to_image, :image_url
 end