Bug#807826: redmine: CVE-2015-8537: Data disclosure in atom feed

[anarcat]

And of course I forgot the patch:

diff --git a/app/views/journals/index.builder b/app/views/journals/index.builder
index a81ff98..7d90346 100644
--- a/app/views/journals/index.builder
+++ b/app/views/journals/index.builder
@@ -19,7 +19,7 @@ xml.feed "xmlns" => "http://www.w3.org/2005/Atom"; do
       end
       xml.content "type" => "html" do
         xml.text! '<ul>'
-        details_to_strings(change.details, false).each do |string|
+        details_to_strings(change.visible_details, false).each do |string|
           xml.text! '<li>' + string + '</li>'
         end
         xml.text! '</ul>'

Fairly trivial, and should be portable to all current versions. This is
basically 7e423fb4538247d59e01958c48b491f196a1de56 but stripping the
tests to ease backporting.

Not tested.

signature.asc
Description: Digital signature