consul/grecia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize translations instead of using _html

Browse Source 
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
This commit is contained in:
Javi Martín
2019-10-06 00:03:50 +02:00
parent b66859945e
commit 6b1864fbcd
62 changed files with 185 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/views/organizations/registrations/success.html.erb
View File

@@ -1,7 +1,7 @@
<h2><%= t("devise_views.organizations.registrations.success.title") %></h2>
<p><%= t("devise_views.organizations.registrations.success.thank_you_html") %></p>
<p><%= t("devise_views.organizations.registrations.success.instructions_1_html") %></p>
<p><%= t("devise_views.organizations.registrations.success.instructions_2_html") %></p>
<p><%= sanitize(t("devise_views.organizations.registrations.success.thank_you")) %></p>
<p><%= sanitize(t("devise_views.organizations.registrations.success.instructions_1")) %></p>
<p><%= sanitize(t("devise_views.organizations.registrations.success.instructions_2")) %></p>
<p><%= t("devise_views.organizations.registrations.success.instructions_3") %></p>
<p>
<%= link_to t("devise_views.organizations.registrations.success.back_to_index"),