From 8406a75abb7af2e07a40f9a1706e2be848044f7f Mon Sep 17 00:00:00 2001 From: Vaibhav Goyal Date: Mon, 13 Jul 2026 17:50:19 +0530 Subject: [PATCH 1/4] OTWO-6331 Solved issue of wrong geolocation getting rendered --- app/helpers/map_helper.rb | 19 ++++++++++--------- app/views/accounts/edit.html.haml | 6 +----- .../initializers/content_security_policy.rb | 3 ++- 3 files changed, 13 insertions(+), 15 deletions(-) diff --git a/app/helpers/map_helper.rb b/app/helpers/map_helper.rb index 1882ed794..2a9942ad8 100644 --- a/app/helpers/map_helper.rb +++ b/app/helpers/map_helper.rb @@ -1,8 +1,8 @@ # frozen_string_literal: true module MapHelper - def map_init(id, zoom = 2) - map_script_load + map_js_initialization(id, zoom) + def map_init(id, zoom = 2, lat = nil, lng = nil) + map_script_load + map_js_initialization(id, zoom, lat, lng) end def map_near_stacks_json(project, params) @@ -39,14 +39,15 @@ def map_script_load "" end - def map_js_initialization(id, zoom) + def map_js_initialization(id, zoom, lat = nil, lng = nil) + jump_callback = lat && lng ? "EditMap.jumpMeTo(#{lat}, #{lng});" : '' javascript_tag <<-JSCRIPT - document.onreadystatechange = function () { - if (document.readyState == "complete") { - OH_Map.load('#{id}', 25, 12, 2); - OH_Map.moveTo(25, 12, #{zoom}); - } - }; + function initOhMap() { + OH_Map.load('#{id}', 25, 12, 2); + OH_Map.moveTo(25, 12, #{zoom}); + #{jump_callback} + } + document.readyState === 'complete' ? initOhMap() : document.addEventListener('readystatechange', function() { if (document.readyState === 'complete') initOhMap(); }); JSCRIPT end diff --git a/app/views/accounts/edit.html.haml b/app/views/accounts/edit.html.haml index 833d94fcd..ef35c1c2e 100644 --- a/app/views/accounts/edit.html.haml +++ b/app/views/accounts/edit.html.haml @@ -3,10 +3,6 @@ .clearfix -- if @account.latitude && @account.longitude - - content_for :javascript do - - callback = "EditMap.jumpMeTo(#{@account.latitude}, #{@account.longitude});" - = javascript_tag "$(document).on('page:change', function(){#{callback}});" #accounts_edits .margin_left_15 @@ -112,4 +108,4 @@ %li = t('.help_5') -!= map_init('map', @account.latitude ? 7 : 0) +!= map_init('map', @account.latitude ? 7 : 0, @account.latitude, @account.longitude) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index dc37b33a5..0fea66b50 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -1,6 +1,7 @@ # frozen_string_literal: true -allowed_script_sources = %w[www.google.com www.gstatic.com s7.addthis.com cdnjs.cloudflare.com] +allowed_script_sources = %w[www.google.com www.gstatic.com maps.googleapis.com maps.gstatic.com s7.addthis.com + cdnjs.cloudflare.com] Rails.application.config.content_security_policy do |policy| policy.default_src :self, :https From 6449c2790a4abe2e616d25dce2a0f426333b8036 Mon Sep 17 00:00:00 2001 From: kumarin Date: Tue, 14 Jul 2026 11:07:28 +0530 Subject: [PATCH 2/4] Revert "OTWO-6331 Solved issue of wrong geolocation getting rendered" This reverts commit 8406a75abb7af2e07a40f9a1706e2be848044f7f. --- app/helpers/map_helper.rb | 19 +++++++++---------- app/views/accounts/edit.html.haml | 6 +++++- .../initializers/content_security_policy.rb | 3 +-- 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/app/helpers/map_helper.rb b/app/helpers/map_helper.rb index 2a9942ad8..1882ed794 100644 --- a/app/helpers/map_helper.rb +++ b/app/helpers/map_helper.rb @@ -1,8 +1,8 @@ # frozen_string_literal: true module MapHelper - def map_init(id, zoom = 2, lat = nil, lng = nil) - map_script_load + map_js_initialization(id, zoom, lat, lng) + def map_init(id, zoom = 2) + map_script_load + map_js_initialization(id, zoom) end def map_near_stacks_json(project, params) @@ -39,15 +39,14 @@ def map_script_load "" end - def map_js_initialization(id, zoom, lat = nil, lng = nil) - jump_callback = lat && lng ? "EditMap.jumpMeTo(#{lat}, #{lng});" : '' + def map_js_initialization(id, zoom) javascript_tag <<-JSCRIPT - function initOhMap() { - OH_Map.load('#{id}', 25, 12, 2); - OH_Map.moveTo(25, 12, #{zoom}); - #{jump_callback} - } - document.readyState === 'complete' ? initOhMap() : document.addEventListener('readystatechange', function() { if (document.readyState === 'complete') initOhMap(); }); + document.onreadystatechange = function () { + if (document.readyState == "complete") { + OH_Map.load('#{id}', 25, 12, 2); + OH_Map.moveTo(25, 12, #{zoom}); + } + }; JSCRIPT end diff --git a/app/views/accounts/edit.html.haml b/app/views/accounts/edit.html.haml index ef35c1c2e..833d94fcd 100644 --- a/app/views/accounts/edit.html.haml +++ b/app/views/accounts/edit.html.haml @@ -3,6 +3,10 @@ .clearfix +- if @account.latitude && @account.longitude + - content_for :javascript do + - callback = "EditMap.jumpMeTo(#{@account.latitude}, #{@account.longitude});" + = javascript_tag "$(document).on('page:change', function(){#{callback}});" #accounts_edits .margin_left_15 @@ -108,4 +112,4 @@ %li = t('.help_5') -!= map_init('map', @account.latitude ? 7 : 0, @account.latitude, @account.longitude) +!= map_init('map', @account.latitude ? 7 : 0) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 0fea66b50..dc37b33a5 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -1,7 +1,6 @@ # frozen_string_literal: true -allowed_script_sources = %w[www.google.com www.gstatic.com maps.googleapis.com maps.gstatic.com s7.addthis.com - cdnjs.cloudflare.com] +allowed_script_sources = %w[www.google.com www.gstatic.com s7.addthis.com cdnjs.cloudflare.com] Rails.application.config.content_security_policy do |policy| policy.default_src :self, :https From a50abd4119af18a3fa545b8f2b3077dbf0abcf07 Mon Sep 17 00:00:00 2001 From: kumarin Date: Tue, 21 Jul 2026 12:47:01 +0530 Subject: [PATCH 3/4] OTWO-7696 remediate high severity SAST findings in openHub ui codebase --- app/assets/javascripts/account_edit.js | 4 +- .../javascripts/jquery.rest_in_place.js | 2 +- app/assets/javascripts/ohloh_suggests.js | 4 +- app/assets/javascripts/org_infographic.js | 4 +- app/assets/javascripts/orgs.js | 3 +- app/controllers/api_keys_controller.rb | 3 +- .../concerns/enlistment_filters.rb | 3 +- app/controllers/languages_controller.rb | 3 +- app/controllers/people_controller.rb | 3 +- docker-compose-utility.yml | 2 + docker-compose.yml | 2 + public/timeline/scripts/sources.js | 199 +++++++++--------- test/helpers/edits_helper_test.rb | 2 +- 13 files changed, 123 insertions(+), 111 deletions(-) diff --git a/app/assets/javascripts/account_edit.js b/app/assets/javascripts/account_edit.js index c29799093..961a247e4 100644 --- a/app/assets/javascripts/account_edit.js +++ b/app/assets/javascripts/account_edit.js @@ -31,7 +31,7 @@ var EditMap = { if (json.success) { marker = EditMap.jumpMeTo(json.latitude, json.longitude); $('#account_country_code').val(json.country); - $('#account_location_mirror').html(json.location); + $('#account_location_mirror').text(json.location); $('#account_location').val(json.location); $('#account_latitude').val(json.latitude); $('#account_longitude').val(json.longitude); @@ -61,7 +61,7 @@ var EditMap = { marker = EditMap.jumpMeTo(loc.lat(), loc.lng()); $('#account_country_code').val(countryCode); - $('#account_location_mirror').html(address); + $('#account_location_mirror').text(address); $('#account_location').val(address); $('#account_latitude').val(loc.lat()); $('#account_longitude').val(loc.lng()); diff --git a/app/assets/javascripts/jquery.rest_in_place.js b/app/assets/javascripts/jquery.rest_in_place.js index 692a22469..5d61d162e 100644 --- a/app/assets/javascripts/jquery.rest_in_place.js +++ b/app/assets/javascripts/jquery.rest_in_place.js @@ -101,7 +101,7 @@ jQuery.fn.rest_in_place = function(url, objectName, attributeName) { dataType: "json", "beforeSend" : function(xhr) { xhr.setRequestHeader("Accept", "application/json"); }, "success" : function(jsondata, status){ - e.html(jsondata[attributeName]); + e.text(jsondata[attributeName]); tearDown(e); return false; } diff --git a/app/assets/javascripts/ohloh_suggests.js b/app/assets/javascripts/ohloh_suggests.js index 477feafbc..5740fa663 100644 --- a/app/assets/javascripts/ohloh_suggests.js +++ b/app/assets/javascripts/ohloh_suggests.js @@ -228,7 +228,7 @@ StackShow = { // we're going to slide up the new recommendations list.css('height', list.height()); // make height fixed, the larger div is overflow:hidde list.find("li").wrapAll("
"); - list.children("ul").append(result.recommendations); + list.children("ul").append($.parseHTML(result.recommendations)); list.find("#delete_me").slideUp(1000, function() { $(this).remove(); list.css('height', 'auto'); @@ -243,7 +243,7 @@ StackShow = { update_count: function(json) { if (json.updated_count) { - $(".listing_result").html(json.updated_count); + $(".listing_result").text(json.updated_count); if (json.updated_count == 0) { $("#empty_stack_text").fadeIn("slow"); } else { diff --git a/app/assets/javascripts/org_infographic.js b/app/assets/javascripts/org_infographic.js index 107f6dbba..c66c5f293 100644 --- a/app/assets/javascripts/org_infographic.js +++ b/app/assets/javascripts/org_infographic.js @@ -13,8 +13,8 @@ OrganizationPictogram = { $.ajax({ url: $(this).attr('url'), success: function(response) { - $('#org_infographic').replaceWith(response.pictogram_html); - $(update).html(response.subview_html); + $('#org_infographic').replaceWith($.parseHTML(response.pictogram_html)); + $(update).html($.parseHTML(response.subview_html)); OrganizationPictogram.init(); Expander.init(); $.unblockUI(); diff --git a/app/assets/javascripts/orgs.js b/app/assets/javascripts/orgs.js index bb71ec81a..8227d970c 100644 --- a/app/assets/javascripts/orgs.js +++ b/app/assets/javascripts/orgs.js @@ -112,7 +112,8 @@ var OrgClaimProject = { type: "GET", url: url, success: function(data){ - $('#'+link_id).replaceWith(data); + var sanitized = $('
').append($.parseHTML(data)).html(); + $('#'+link_id).replaceWith(sanitized); } }); return false; diff --git a/app/controllers/api_keys_controller.rb b/app/controllers/api_keys_controller.rb index b3ade9fae..6b68c26b5 100644 --- a/app/controllers/api_keys_controller.rb +++ b/app/controllers/api_keys_controller.rb @@ -93,7 +93,8 @@ def find_models end def parse_sort_term - ApiKey.respond_to?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_newest' + allowed = %w[by_account_name by_newest by_oldest by_most_requests_today by_most_requests by_most_recent_request] + allowed.include?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_newest' end def default_or_csv_limit diff --git a/app/controllers/concerns/enlistment_filters.rb b/app/controllers/concerns/enlistment_filters.rb index 4a65c82e4..4790fb07e 100644 --- a/app/controllers/concerns/enlistment_filters.rb +++ b/app/controllers/concerns/enlistment_filters.rb @@ -24,7 +24,8 @@ def enlistment_params end def parse_sort_term - Enlistment.respond_to?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_url' + allowed = %w[by_url by_project by_type by_module_name by_last_update by_update_status] + allowed.include?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_url' end def find_enlistment diff --git a/app/controllers/languages_controller.rb b/app/controllers/languages_controller.rb index fcdbacbd2..50a7e1c7e 100644 --- a/app/controllers/languages_controller.rb +++ b/app/controllers/languages_controller.rb @@ -49,6 +49,7 @@ def find_languages end def parse_sort_term - Language.respond_to?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_nice_name' + allowed = %w[by_name by_nice_name by_total by_code by_comment_ratio by_projects by_contributors by_commits] + allowed.include?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_nice_name' end end diff --git a/app/controllers/people_controller.rb b/app/controllers/people_controller.rb index e03fff694..32ea21bc8 100644 --- a/app/controllers/people_controller.rb +++ b/app/controllers/people_controller.rb @@ -44,6 +44,7 @@ def find_rankings_people end def parse_sort_term - Person.respond_to?("sort_by_#{params[:sort]}") ? "sort_by_#{params[:sort]}" : 'sort_by_kudo_position' + allowed = %w[sort_by_kudo_position sort_by_effective_name] + allowed.include?("sort_by_#{params[:sort]}") ? "sort_by_#{params[:sort]}" : 'sort_by_kudo_position' end end diff --git a/docker-compose-utility.yml b/docker-compose-utility.yml index cdfd05d04..4af9f6402 100644 --- a/docker-compose-utility.yml +++ b/docker-compose-utility.yml @@ -5,6 +5,8 @@ services: container_name: "${DOCKER_HOST_NAME}" command: '/start_utility.sh' hostname: "${DOCKER_HOST_NAME}" + cap_drop: + - NET_RAW ports: - '6379:6379' - '8086:8086' diff --git a/docker-compose.yml b/docker-compose.yml index c043c60b1..0c34f50c3 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,6 +5,8 @@ services: container_name: "${DOCKER_HOST_NAME}" command: '/start.sh' hostname: "${DOCKER_HOST_NAME}" + cap_drop: + - NET_RAW ports: - "443:443" volumes: diff --git a/public/timeline/scripts/sources.js b/public/timeline/scripts/sources.js index 9173b6439..1241d6dd1 100644 --- a/public/timeline/scripts/sources.js +++ b/public/timeline/scripts/sources.js @@ -53,12 +53,12 @@ Timeline.DefaultEventSource.prototype.loadXML = function(xml, url) { this._resolveRelativeURL(node.getAttribute("icon"), base), node.getAttribute("color"), node.getAttribute("textColor") - ); - evt._node = node; - evt.getProperty = function(name) { - return this._node.getAttribute(name); + ); + evt._node = node; + evt.getProperty = function(name) { + return this._node.getAttribute(name); }; - evt.setWikiInfo(wikiURL, wikiSection); + evt.setWikiInfo(wikiURL, wikiSection); this._events.add(evt); @@ -93,18 +93,18 @@ Timeline.DefaultEventSource.prototype.loadJSON = function(data, url) { event.isDuration || false, event.title, event.description, - "", // NYI -- ajaxDescription + "", // NYI -- ajaxDescription this._resolveRelativeURL(event.image, base), this._resolveRelativeURL(event.link, base), this._resolveRelativeURL(event.icon, base), event.color, event.textColor - ); - evt._obj = event; - evt.getProperty = function(name) { - return this._obj[name]; + ); + evt._obj = event; + evt.getProperty = function(name) { + return this._obj[name]; }; - evt.setWikiInfo(wikiURL, wikiSection); + evt.setWikiInfo(wikiURL, wikiSection); this._events.add(evt); added = true; @@ -114,10 +114,10 @@ Timeline.DefaultEventSource.prototype.loadJSON = function(data, url) { if (added) { this._fire("onAddMany", []); } -}; - -/* - * Contributed by Morten Frederiksen, http://www.wasab.dk/morten/ +}; + +/* + * Contributed by Morten Frederiksen, http://www.wasab.dk/morten/ */ Timeline.DefaultEventSource.prototype.loadSPARQL = function(xml, url) { var base = this._getBaseURL(url); @@ -126,16 +126,16 @@ Timeline.DefaultEventSource.prototype.loadSPARQL = function(xml, url) { var parseDateTimeFunction = this._events.getUnit().getParser(dateTimeFormat); if (xml == null) { - return; - } - - /* - * Find tag + return; + } + + /* + * Find tag */ var node = xml.documentElement.firstChild; while (node != null && (node.nodeType != 1 || node.nodeName != 'results')) { - node = node.nextSibling; - } + node = node.nextSibling; + } var wikiURL = null; var wikiSection = null; @@ -143,8 +143,8 @@ Timeline.DefaultEventSource.prototype.loadSPARQL = function(xml, url) { wikiURL = node.getAttribute("wiki-url"); wikiSection = node.getAttribute("wiki-section"); - node = node.firstChild; - } + node = node.firstChild; + } var added = false; while (node != null) { @@ -152,19 +152,19 @@ Timeline.DefaultEventSource.prototype.loadSPARQL = function(xml, url) { var bindings = { }; var binding = node.firstChild; while (binding != null) { - if (binding.nodeType == 1 && - binding.firstChild != null && - binding.firstChild.nodeType == 1 && - binding.firstChild.firstChild != null && + if (binding.nodeType == 1 && + binding.firstChild != null && + binding.firstChild.nodeType == 1 && + binding.firstChild.firstChild != null && binding.firstChild.firstChild.nodeType == 3) { - bindings[binding.getAttribute('name')] = binding.firstChild.firstChild.nodeValue; + bindings[binding.getAttribute('name')] = binding.firstChild.firstChild.nodeValue; } binding = binding.nextSibling; - } + } if (bindings["start"] == null && bindings["date"] != null) { - bindings["start"] = bindings["date"]; - } + bindings["start"] = bindings["date"]; + } var evt = new Timeline.DefaultEventSource.Event( parseDateTimeFunction(bindings["start"]), @@ -183,7 +183,7 @@ Timeline.DefaultEventSource.prototype.loadSPARQL = function(xml, url) { evt._bindings = bindings; evt.getProperty = function(name) { return this._bindings[name]; - }; + }; evt.setWikiInfo(wikiURL, wikiSection); this._events.add(evt); @@ -210,7 +210,7 @@ Timeline.DefaultEventSource.prototype.addMany = function(events) { }; Timeline.DefaultEventSource.prototype.clear = function() { - this._events.removeAll(); + this._events.removeAll(); this._fire("onClear", []); }; @@ -232,17 +232,17 @@ Timeline.DefaultEventSource.prototype.getEarliestDate = function() { Timeline.DefaultEventSource.prototype.getLatestDate = function() { return this._events.getLatestDate(); -}; - +}; + Timeline.DefaultEventSource.prototype._fire = function(handlerName, args) { - for (var i = 0; i < this._listeners.length; i++) { - var listener = this._listeners[i]; - if (handlerName in listener) { - try { - listener[handlerName].apply(listener, args); - } catch (e) { - Timeline.Debug.exception(e); - } + for (var i = 0; i < this._listeners.length; i++) { + var listener = this._listeners[i]; + if (handlerName in listener) { + try { + listener[handlerName].apply(listener, args); + } catch (e) { + Timeline.Debug.exception(e); + } } } }; @@ -307,7 +307,7 @@ Timeline.DefaultEventSource.Event = function( this._wikiSection = null; }; -Timeline.DefaultEventSource.Event.prototype = { +Timeline.DefaultEventSource.Event.prototype = { getID: function() { return this._id; }, isInstant: function() { return this._instant; }, @@ -326,8 +326,8 @@ Timeline.DefaultEventSource.Event.prototype = { getIcon: function() { return this._icon; }, getColor: function() { return this._color; }, - getTextColor: function() { return this._textColor; }, - + getTextColor: function() { return this._textColor; }, + getProperty: function(name) { return null; }, getWikiURL: function() { return this._wikiURL; }, @@ -383,54 +383,57 @@ Timeline.DefaultEventSource.Event.prototype = { elmt.appendChild(elmt.ownerDocument.createTextNode(labeller.labelPrecise(this._end))); } } - }, - fillInfoBubble: function(elmt, theme, labeller) { - var doc = elmt.ownerDocument; - - var title = this.getText(); - var link = this.getLink(); - var image = this.getImage(); - - if (image != null) { - var img = doc.createElement("img"); - img.src = image; - - theme.event.bubble.imageStyler(img); - elmt.appendChild(img); - } - - var divTitle = doc.createElement("div"); - var textTitle = doc.createTextNode(title); - if (link != null) { - var a = doc.createElement("a"); - a.href = link; - a.appendChild(textTitle); - divTitle.appendChild(a); - } else { - divTitle.appendChild(textTitle); - } - theme.event.bubble.titleStyler(divTitle); - elmt.appendChild(divTitle); - - var divBody = doc.createElement("div"); - var bodyId = "id" + Math.floor(Math.random() * Math.pow(10, 12)); - divBody.id = bodyId; - this.fillDescription(divBody); - theme.event.bubble.bodyStyler(divBody); - elmt.appendChild(divBody); - - var divTime = doc.createElement("div"); - this.fillTime(divTime, labeller); - theme.event.bubble.timeStyler(divTime); - elmt.appendChild(divTime); - - var divWiki = doc.createElement("div"); - this.fillWikiInfo(divWiki); - theme.event.bubble.wikiStyler(divWiki); - elmt.appendChild(divWiki); - - if (this._ajaxDescription != null) { - $.ajax({ url: this._ajaxDescription, success: function(html) { $("#" + bodyId).html(html); } }); - } - } -}; + }, + fillInfoBubble: function(elmt, theme, labeller) { + var doc = elmt.ownerDocument; + + var title = this.getText(); + var link = this.getLink(); + var image = this.getImage(); + + if (image != null) { + var img = doc.createElement("img"); + img.src = image; + + theme.event.bubble.imageStyler(img); + elmt.appendChild(img); + } + + var divTitle = doc.createElement("div"); + var textTitle = doc.createTextNode(title); + if (link != null) { + var a = doc.createElement("a"); + a.href = link; + a.appendChild(textTitle); + divTitle.appendChild(a); + } else { + divTitle.appendChild(textTitle); + } + theme.event.bubble.titleStyler(divTitle); + elmt.appendChild(divTitle); + + var divBody = doc.createElement("div"); + var bodyId = "id" + Math.floor(Math.random() * Math.pow(10, 12)); + divBody.id = bodyId; + this.fillDescription(divBody); + theme.event.bubble.bodyStyler(divBody); + elmt.appendChild(divBody); + + var divTime = doc.createElement("div"); + this.fillTime(divTime, labeller); + theme.event.bubble.timeStyler(divTime); + elmt.appendChild(divTime); + + var divWiki = doc.createElement("div"); + this.fillWikiInfo(divWiki); + theme.event.bubble.wikiStyler(divWiki); + elmt.appendChild(divWiki); + + if (this._ajaxDescription != null) { + $.ajax({ url: this._ajaxDescription, success: function(html) { + var sanitized = $("
").append($.parseHTML(html)).html(); + $("#" + bodyId).html(sanitized); + }}); + } + } +}; diff --git a/test/helpers/edits_helper_test.rb b/test/helpers/edits_helper_test.rb index cabc389c6..2a295bf4b 100644 --- a/test/helpers/edits_helper_test.rb +++ b/test/helpers/edits_helper_test.rb @@ -16,7 +16,7 @@ class EditsHelperTest < ActionView::TestCase it 'drop the year if it was this year' do other_time = 17.days.ago dont_fail_around_new_years_date = Time.new(Time.current.year, other_time.month, other_time.day).in_time_zone - _(edit_humanize_datetime(dont_fail_around_new_years_date)).wont_match Time.current.year + _(edit_humanize_datetime(dont_fail_around_new_years_date)).wont_match Time.current.year.to_s end it 'includes the year if it was before this year' do From ef2ccf68a679a07b7c45e8978f56206224c3c077 Mon Sep 17 00:00:00 2001 From: kumarin Date: Tue, 21 Jul 2026 13:53:15 +0530 Subject: [PATCH 4/4] review suggestions fix --- app/assets/javascripts/org_infographic.js | 2 +- app/assets/javascripts/orgs.js | 4 ++-- public/timeline/scripts/sources.js | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/app/assets/javascripts/org_infographic.js b/app/assets/javascripts/org_infographic.js index c66c5f293..6240c04ae 100644 --- a/app/assets/javascripts/org_infographic.js +++ b/app/assets/javascripts/org_infographic.js @@ -14,7 +14,7 @@ OrganizationPictogram = { url: $(this).attr('url'), success: function(response) { $('#org_infographic').replaceWith($.parseHTML(response.pictogram_html)); - $(update).html($.parseHTML(response.subview_html)); + $(update).empty().append($.parseHTML(response.subview_html)); OrganizationPictogram.init(); Expander.init(); $.unblockUI(); diff --git a/app/assets/javascripts/orgs.js b/app/assets/javascripts/orgs.js index 8227d970c..e8f2a9da2 100644 --- a/app/assets/javascripts/orgs.js +++ b/app/assets/javascripts/orgs.js @@ -112,8 +112,8 @@ var OrgClaimProject = { type: "GET", url: url, success: function(data){ - var sanitized = $('
').append($.parseHTML(data)).html(); - $('#'+link_id).replaceWith(sanitized); + var parsed = $.parseHTML(data); + $('#' + link_id).replaceWith(parsed); } }); return false; diff --git a/public/timeline/scripts/sources.js b/public/timeline/scripts/sources.js index 1241d6dd1..729438469 100644 --- a/public/timeline/scripts/sources.js +++ b/public/timeline/scripts/sources.js @@ -431,8 +431,8 @@ Timeline.DefaultEventSource.Event.prototype = { if (this._ajaxDescription != null) { $.ajax({ url: this._ajaxDescription, success: function(html) { - var sanitized = $("
").append($.parseHTML(html)).html(); - $("#" + bodyId).html(sanitized); + var parsed = $.parseHTML(html); + $("#" + bodyId).empty().append(parsed); }}); } }