From 5e69ad2ceae8d3619775695b7fcab62a7a32377a Mon Sep 17 00:00:00 2001
From: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Date: Mon, 25 Feb 2013 22:51:15 +0200
Subject: [PATCH] Sanitize user profile input

---
 app/controllers/profiles_controller.rb | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/controllers/profiles_controller.rb b/app/controllers/profiles_controller.rb
index 051a6664519..6fa114a4194 100644
--- a/app/controllers/profiles_controller.rb
+++ b/app/controllers/profiles_controller.rb
@@ -1,4 +1,6 @@
 class ProfilesController < ApplicationController
+  include ActionView::Helpers::SanitizeHelper
+
   before_filter :user
   layout 'profile'
 
@@ -12,7 +14,7 @@ class ProfilesController < ApplicationController
   end
 
   def update
-    if @user.update_attributes(params[:user])
+    if @user.update_attributes(user_attributes)
       flash[:notice] = "Profile was successfully updated"
     else
       flash[:alert] = "Failed to update profile"
@@ -65,4 +67,17 @@ class ProfilesController < ApplicationController
   def user
     @user = current_user
   end
+
+  def user_attributes
+    user_attributes = params[:user]
+
+    # Sanitize user input because we dont have strict
+    # validation for this fields
+    %w(name skype linkedin twitter bio).each do |attr|
+      value = user_attributes[attr]
+      user_attributes[attr] = sanitize(value) if value.present?
+    end
+
+    user_attributes
+  end
 end