Skip to content

Don't render old data project / group names tags [can be updated]

Created by: cirosantilli

which could be added to the database before the current column validation was in place.

Before this PR, sanitize would allow good tags to be rendered and remove bad tags like script.

After this, any tags will be HTML escaped instead of sanitized, so both bad and good tags will appear escaped.

Rationale: people who entered data earlier should not be able to do things that newer users can't. When we forbid something from being done, we should warn users who did it to prepare to migrate.

This continues the discussions at: https://github.com/gitlabhq/gitlabhq/pull/8107#issuecomment-61004035

Merge request reports