9 Commits (cc89242df993f43069449e008ed8e876151fac3e)

Author	SHA1	Message	Date
Oliver Günther	7cf11bb689	Update copyright notice	8 years ago
Oliver Günther	60cbf95b44	Fix escaping angular expressions when in isolated scope ... Isolated scopes do not inherit from rootScope and thus do not have `DOUBLE_LEFT_CURLY_BRACE`. However, every scope has a reference to the rootScope with `scope.$root` (https://docs.angularjs.org/api/ng/type/$rootScope.Scope)	8 years ago
Oliver Günther	1832ff91f0	[24050] Unescape formattable html strings inserted as ng-bind-html ... The description and all other formattable fields are applied to the dom with `ng-bind-html`. These directives never compile their contents, thus any escaped expression `{{ ... }}` entered by the user is never evaluated. We can either: 1. Compile the content needlessly just to remove escaped expressions. 2. Remove the escaped expression explicitly. This PR implements the second approach. https://community.openproject.com/work_packages/24050/activity	8 years ago
Oliver Günther	7fe77ac223	Add spec for correct escaping in wiki preview	8 years ago
Oliver Günther	5f8ebfdfc6	Add feature spec to test expiry of sessions	8 years ago
Oliver Günther	44a98b8155	Extend xss spec	8 years ago
Oliver Günther	43599a9179	Add feature spec for angular XSS	9 years ago