vendor/plugins/cross_site_sniper/lib/cross_site_sniper.rb
# Piggybacks onto the end of ActiveRecord's define_attribute_methods
# to wrap and automatically html_escape string and text fields.
Piggybacks onto the end of ActiveRecord's define_attribute_methods
to wrap and automatically html_escape string and text fields.
Piggybacks onto the end of ActiveRecord ' s define_attribute_methods to wrap and automatically html_escape string and text fields .
def define_attribute_methods_with_html_escaping
        define_attribute_methods_without_html_escaping
        content_columns.each do |column|
          next unless [:string,:text].include?(column.type)
          next unless generated_methods.include?(column.name)
          next if  @cross_site_sniper_excepted_fields and (@cross_site_sniper_excepted_fields.include?(column.name) or @cross_site_sniper_excepted_fields.include?(column.name.to_sym))
          if @cross_site_sniper_only_fields
            next unless @cross_site_sniper_only_fields.include?(column.name) or @cross_site_sniper_only_fields.include?(column.name.to_sym)
          end
          define_method("#{column.name}_with_html_escaping") do
            val = send("#{column.name}_without_html_escaping")
            return val if @html_escaping_disabled
            val.is_a?(String) ? ERB::Util::h(val) : val
          end
          alias_method_chain column.name.to_sym, :html_escaping
          generated_methods << "#{column.name}_with_html_escaping"
          generated_methods << "#{column.name}_without_html_escaping"
        end
      end
def define_attribute_methods_with_html_escaping define_attribute_methods_without_html_escaping content_columns . each do | column | next unless [ :string , :text ] . include? ( column . type ) next unless generated_methods . include? ( column . name ) next if @cross_site_sniper_excepted_fields and ( @cross_site_sniper_excepted_fields . include? ( column . name ) or @cross_site_sniper_excepted_fields . include? ( column . name . to_sym ) ) if @cross_site_sniper_only_fields next unless @cross_site_sniper_only_fields . include? ( column . name ) or @cross_site_sniper_only_fields . include? ( column . name . to_sym ) end define_method ( "#{column.name}_with_html_escaping" ) do val = send ( "#{column.name}_without_html_escaping" ) return val if @html_escaping_disabled val . is_a? ( String ) ? ERB :: Util :: h ( val ) : val end alias_method_chain column . name . to_sym , :html_escaping generated_methods << "#{column.name}_with_html_escaping" generated_methods << "#{column.name}_without_html_escaping" end end
Piggybacks onto the end of ActiveRecord's define_attribute_methods
to wrap and automatically html_escape string and text fields.
Piggybacks onto the end of ActiveRecord ' s define_attribute_methods to wrap and automatically html_escape string and text fields .
# Let ActiveRecord define it's methods first. #Bail outta here if we're in an STI subclass situation. #Primary class will get the magic methods. #!! originally added due to double escaping in STI models #!! then removed because STI models stopped escaping at all #!! and doulble escaping could not be reproduced. If double #!! escaping re-appears, need to isolate exactly when and why #!! to properly deal with it.  #return unless descends_from_active_record? #Only escape string and text fields #Only escape fields that had their methods generated automatically. #in order not to interfere if the class defined it's own method. #Skip fields designated as not escaped #Skip fields designated as not escaped # Retrieve the raw data. #if htmlescaping is disabled, just send it as is. # Only escape strings. Other data types, such # as 'nil', should be returned uncorrupted. # Add newly generated methods to list just # in case we were called directly from # ActiveRecord::AttributeMethods::method_missing # and one of these is the missing method.