Files
grecia/app/views/admin/site_customization/pages/_form.html.erb
Javi Martín 6b1864fbcd Sanitize translations instead of using _html
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
2019-10-09 19:46:47 +02:00

63 lines
2.0 KiB
Plaintext

<%= render "shared/globalize_locales", resource: @page %>
<%= translatable_form_for [:admin, @page], html: { class: "edit_page", data: { watch_changes: true } } do |f| %>
<% if @page.errors.any? %>
<div id="error_explanation" data-alert class="callout alert" data-closable>
<button class="close-button" aria-label="<%= t("application.close") %>" type="button" data-close>
<span aria-hidden="true">&times;</span>
</button>
<strong>
<%= @page.errors.count %>
<%= t("admin.site_customization.pages.errors.form.error", count: @page.errors.count) %>
</strong>
</div>
<% end %>
<div class="row">
<div class="small-12 column">
<hr>
</div>
<div class="small-12 medium-4 column">
<h3><%= t("admin.site_customization.pages.form.options") %></h3>
<%= f.label :status %>
<% ::SiteCustomization::Page::VALID_STATUSES.each do |status| %>
<%= f.radio_button :status, status %>
<br>
<% end %>
<%= f.check_box :more_info_flag, class: "small" %>
<%= f.check_box :print_content_flag %>
</div>
<div class="small-12 medium-6 column">
<%= f.text_field :slug, size: 80, maxlength: 80,
hint: sanitize(t("admin.site_customization.pages.new.slug_help")) %>
</div>
</div>
<div class="row">
<div class="small-12 column">
<hr>
<%= f.translatable_fields do |translations_form| %>
<div class="small-12 column end">
<%= translations_form.text_field :title %>
</div>
<div class="small-12 column">
<%= translations_form.text_field :subtitle %>
</div>
<div class="ckeditor column">
<%= translations_form.cktext_area :content,
ckeditor: { language: I18n.locale, toolbar: "admin" } %>
</div>
<% end %>
</div>
</div>
<div class="row">
<div class="small-12 medium-6 large-3 margin-top column">
<%= f.submit class: "button success expanded" %>
</div>
</div>
<% end %>