diff --git a/app/models/user.rb b/app/models/user.rb index 4b01c2f19f079494c680a8260c02b74a759fa87c..2d39b1c1c343259a54005d45d7979040d6942d29 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -699,7 +699,7 @@ class User < ActiveRecord::Base end def sanitize_attrs - %w[name username skype linkedin twitter].each do |attr| + %w[username skype linkedin twitter].each do |attr| value = public_send(attr) public_send("#{attr}=", Sanitize.clean(value)) if value.present? end diff --git a/changelogs/unreleased/10085-stop-encoding-user-name.yml b/changelogs/unreleased/10085-stop-encoding-user-name.yml new file mode 100644 index 0000000000000000000000000000000000000000..8fab474e047eec05ebc1afb98664822d3e15bbaf --- /dev/null +++ b/changelogs/unreleased/10085-stop-encoding-user-name.yml @@ -0,0 +1,4 @@ +--- +title: "Insert user name directly without encoding" +merge_request: 10085 +author: Nathan Neulinger diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index d04162a527f79e0f86961c40c6908db9f590fb27..c70f916a8bd2f5e8acd5caf2ca46f5575193aab8 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -1159,6 +1159,18 @@ describe User, models: true do end end + describe '#sanitize_attrs' do + let(:user) { build(:user, name: 'test & user', skype: 'test&user') } + + it 'encodes HTML entities in the Skype attribute' do + expect { user.sanitize_attrs }.to change { user.skype }.to('test&user') + end + + it 'does not encode HTML entities in the name attribute' do + expect { user.sanitize_attrs }.not_to change { user.name } + end + end + describe '#starred?' do it 'determines if user starred a project' do user = create :user