VRFS-1971 escape HTML before saving / unescape before rendering

web/Gemfile

@@ -77,6 +77,7 @@ gem 'rest_client'
 gem 'iso-639'
 gem 'language_list'
 gem 'rubyzip'
+gem 'htmlentities'
 
 group :development, :test do
   gem 'rspec-rails', '2.14.2'

web/app/assets/javascripts/dialog/commentDialog.js

@@ -71,7 +71,7 @@
         user_id: userId,
         hoverAction: musician ? "musician" : "fan",
         name: userName,
-        comment: comment,
+        comment: context._.unescape(comment),
         timeago: timeago
       };
 

web/app/assets/javascripts/web/session_info.js

@@ -39,7 +39,7 @@
         user_id: userId,
         hoverAction: "musician",
         name: userName,
-        comment: comment,
+        comment: context._.unescape(comment),
         timeago: timeago
       });
 

web/app/assets/javascripts/web/sessions.js

@@ -39,7 +39,7 @@
         user_id: userId,
         hoverAction: musician ? "musician" : "fan",
         name: userName,
-        comment: comment,
+        comment: context._.unescape(comment),
         timeago: timeago
       });
 

web/app/controllers/api_controller.rb

@@ -1,6 +1,7 @@
 class ApiController < ApplicationController
 
   @@log = Logging.logger[ApiController]
+  @@html_encoder = HTMLEntities.new
 
   # define common error handlers
   rescue_from 'JamRuby::StateError' do |exception|

web/app/controllers/api_music_sessions_controller.rb

@@ -469,7 +469,7 @@ class ApiMusicSessionsController < ApiController
     comment = MusicSessionComment.new
     comment.music_session_id = params[:id]
     comment.creator_id = params[:user_id]
-    comment.comment = params[:comment]
+    comment.comment = @@html_encoder.encode(params[:comment])
     comment.ip_address = request.remote_ip
     comment.save
 
@@ -496,7 +496,7 @@ class ApiMusicSessionsController < ApiController
     comment = SessionInfoComment.new
     comment.music_session_id = params[:id]
     comment.creator_id = current_user.id
-    comment.comment = params[:comment]
+    comment.comment = @@html_encoder.encode(params[:comment])
     comment.save
 
     if comment.errors.any?

web/app/controllers/api_recordings_controller.rb

@@ -108,7 +108,7 @@ class ApiRecordingsController < ApiController
     comment = RecordingComment.new
     comment.recording_id = params[:id]
     comment.creator_id = params[:user_id]
-    comment.comment = params[:comment]
+    comment.comment = @@html_encoder.encode(params[:comment])
     comment.ip_address = request.remote_ip
     comment.save