consul/grecia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize translations instead of using _html

Browse Source 
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
This commit is contained in:
Javi Martín
2019-10-06 00:03:50 +02:00
parent b66859945e
commit 6b1864fbcd
62 changed files with 185 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/admin/legislation/draft_versions/_form.html.erb
View File

@@ -36,9 +36,9 @@
<div class="markdown-editor clear">
<div class="small-12 medium-8 column fullscreen-container">
<div class="markdown-editor-header truncate">
<%= t("admin.legislation.draft_versions.form.title_html",
<%= sanitize(t("admin.legislation.draft_versions.form.title",
draft_version_title: @draft_version.title,
process_title: @process.title) %>
process_title: @process.title)) %>
</div>
<div class="markdown-editor-buttons">