hdgarrood / redmine_release_notes

A plugin to add release notes to Redmine
GNU General Public License v3.0
73 stars 47 forks source link

custom field values with special characters breaks several pages (mainly looking at versions) #121

Open jcsturges opened 9 years ago

jcsturges commented 9 years ago

In the custom list field used to specify release note status if you have a special character like an apostrophe as a possible value it will break pages referencing the item version (500 error). I noticed this watching the logs, I had an option for "Don't Include" and the ' in Don't isn't being escaped properly so the page breaks.

Sample stack trace, using PostgreSQL in this case (Postgres uses a single quoting character for strings so a single quote in a single quoted string should be escaped):

Processing by VersionsController#show as HTML Parameters: {"id"=>"2"} Current user: james (id=3) Rendered versions/_overview.html.erb (9.9ms) Rendered versions/_issue_counts.html.erb (2.5ms) Rendered plugins/redmine_release_notes/app/views/release_notes/_dashboard.html.erb (14.4ms) Rendered plugins/redmine_release_notes/app/views/hooks/release_notes/_version_show_bottom.html.erb (15.2ms) Rendered versions/show.html.erb within layouts/base (46.8ms) Completed 500 Internal Server Error in 60.2ms

ActionView::Template::Error (PG::SyntaxError: ERROR: syntax error at or near "t" LINE 1: ...ustom_field_id = 2 AND custom_values.value = 'Don't Include'... ^ : SELECT COUNT(DISTINCT "issues"."id") FROM "issues" LEFT OUTER JOIN "custom_values" ON "custom_values"."customized_id" = "issues"."$ 1: <% stats = version.release_notes_stats %> 2: <% cf_none_value = Setting.plugin_redmine_release_notes[:field_value_not_required] %> 3: <% cf_name = CustomField.find_by_id(Setting.plugin_redmine_release_notes[:issue_custom_field_id]).name %> 4: lib/redmine/hook.rb:61:in block (2 levels) in call_hook' lib/redmine/hook.rb:61:ineach' lib/redmine/hook.rb:61:in block in call_hook' lib/redmine/hook.rb:58:intap' lib/redmine/hook.rb:58:in call_hook' lib/redmine/hook.rb:158:incall_hook' app/views/versions/show.html.erb:52:in `_app_views_versions_show_html_erb__2650088249925986348_51359100'