Files
grecia/app/views/shared/_common_globalize_locales.html.erb
Javi Martín 6b1864fbcd Sanitize translations instead of using _html
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
2019-10-09 19:46:47 +02:00

34 lines
1.6 KiB
Plaintext

<div class="row globalize-languages column padding-top <%= highlight_translation_html_class %>"
data-zero-languages-description="<%= sanitize(t("shared.translations.languages_in_use", count: 0)) %>"
data-one-languages-description="<%= sanitize(t("shared.translations.languages_in_use", count: 1)) %>"
data-other-languages-description="<%= sanitize(t("shared.translations.languages_in_use", count: 2)) %>">
<div class="small-6 large-3 column">
<span class="small">
<strong class="js-languages-description"><%= selected_languages_description(resource) %></strong>
</span>
<%= select_tag :select_language,
options_for_select_language(resource),
prompt: t("shared.translations.select_language_prompt"),
class: "js-select-language" %>
<%= select_language_error(resource) %>
<div class="margin-bottom">
<% if manage_languages %>
<% I18n.available_locales.each do |locale| %>
<%= link_to t("shared.translations.remove_language"), "#",
style: display_destroy_locale_style(resource, locale),
class: "delete js-delete-language js-delete-#{locale}",
data: { locale: locale } %>
<% end %>
<% end %>
</div>
</div>
<div class="small-6 large-3 column margin-top end">
<% if manage_languages %>
<%= select_tag :add_language,
options_for_add_language,
prompt: t("shared.translations.add_language"),
class: "js-add-language" %>
<% end %>
</div>
</div>