[PR #2122] [MERGED] Fix username rendering bug #16241

New Issue

GiteaMirror · 2025-11-02T12:05:42-06:00

GiteaMirror commented

2025-11-02 12:05:42 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/2122
Author: @ethantkoenig
Created: 7/7/2017
Status: ✅ Merged
Merged: 7/12/2017
Merged by: @lafriks

Base: master ← Head: fix/render

📝 Commits (3)

96fac0e Fix username rendering bug
78b1741 XSS integration test
3a3d480 Migration to unescape user full names

📊 Changes

4 files changed (+71 additions, -4 deletions)

View changed files

➕ integrations/xss_test.go (+37 -0)
📝 models/migrations/migrations.go (+2 -0)
➕ models/migrations/v37.go (+32 -0)
📝 models/user.go (+0 -4)

📄 Description

Fixes #1629.

Don't sanitize user's full names in the database. Since user.FullName and user.DisplayName() are strings, they are automatically already sanitized by the templating engine. If we sanitize the values stored in the database, users' full name end up being up sanitized twice.

~~I'm planning to add an integration test soon.~~ Added an integration test

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/2122 **Author:** [@ethantkoenig](https://github.com/ethantkoenig) **Created:** 7/7/2017 **Status:** ✅ Merged **Merged:** 7/12/2017 **Merged by:** [@lafriks](https://github.com/lafriks) **Base:** `master` ← **Head:** `fix/render` --- ### 📝 Commits (3) - [`96fac0e`](https://github.com/go-gitea/gitea/commit/96fac0e373c90501b0d0b4acbc21e792a8f836ec) Fix username rendering bug - [`78b1741`](https://github.com/go-gitea/gitea/commit/78b17414bb7f4e721f820c44f40f51fea74c584c) XSS integration test - [`3a3d480`](https://github.com/go-gitea/gitea/commit/3a3d4807f4f7de3d12bcfc727b1f3623f904cfae) Migration to unescape user full names ### 📊 Changes **4 files changed** (+71 additions, -4 deletions) <details> <summary>View changed files</summary> ➕ `integrations/xss_test.go` (+37 -0) 📝 `models/migrations/migrations.go` (+2 -0) ➕ `models/migrations/v37.go` (+32 -0) 📝 `models/user.go` (+0 -4) </details> ### 📄 Description Fixes #1629. Don't sanitize user's full names in the database. Since `user.FullName` and `user.DisplayName()` are strings, they are automatically already sanitized by the templating engine. If we sanitize the values stored in the database, users' full name end up being up sanitized twice. ~I'm planning to add an integration test soon.~ Added an integration test --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 12:05:42 -06:00

GiteaMirror closed this issue

2025-11-02 12:05:42 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#16241