7bf4e4d611
Sanitizing descriptions before saving a record has a few drawbacks: 1. It makes the application rely on data being safe in the database. If somehow dangerous data enters the database, the application will be vulnerable to XSS attacks 2. It makes the code complicated 3. It isn't backwards compatible; if we decide to disallow a certain HTML tag in the future, we'd need to sanitize existing data. On the other hand, sanitizing the data in the view means we don't need to triple-check dangerous HTML has already been stripped when we see the method `auto_link_already_sanitized_html`, since now every time we use it we sanitize the text in the same line we call this method. We could also sanitize the data twice, both when saving to the database and when displaying values in the view. However, doing so wouldn't make the application safer, since we sanitize text introduced through textarea fields but we don't sanitize text introduced through input fields. Finally, we could also overwrite the `description` method so it sanitizes the text. But we're already introducing Globalize which overwrites that method, and overwriting it again is a bit too confusing in my humble opinion. It can also lead to hard-to-debug behaviour.
145 lines
5.8 KiB
Plaintext
145 lines
5.8 KiB
Plaintext
<%= provide :title, t("social_share.polls_show.title_#{@poll.id}", default: @poll.title) %>
|
|
<%= provide :meta_description, t("social_share.polls_show.description_#{@poll.id}", default: @poll.title) %>
|
|
<%= provide :social_media_meta_tags do %>
|
|
<%= render "shared/social_media_meta_tags",
|
|
social_url: poll_url,
|
|
social_title: t("social_share.polls_show.title_#{@poll.id}", default: @poll.title),
|
|
social_description: t("social_share.polls_show.facebook_#{@poll.id}", default: @poll.title),
|
|
twitter_image_url: "social_media_polls_twitter.jpg",
|
|
og_image_url: "social_media_polls.jpg" %>
|
|
<% end %>
|
|
|
|
<div class="polls-show">
|
|
<%= render "poll_header" %>
|
|
|
|
<%= render "poll_subnav" %>
|
|
|
|
<div class="row margin">
|
|
<div class="small-12 medium-9 column">
|
|
<%= render "callout" %>
|
|
|
|
<% if @poll.voted_in_booth?(current_user) %>
|
|
<div class="callout warning">
|
|
<%= t("polls.show.already_voted_in_booth") %>
|
|
</div>
|
|
<% else %>
|
|
|
|
<% if current_user && @poll.voted_in_web?(current_user) && !@poll.expired? %>
|
|
<div class="callout warning">
|
|
<%= t("polls.show.already_voted_in_web") %>
|
|
</div>
|
|
<% end %>
|
|
<% end %>
|
|
|
|
<% @questions.each do |question| %>
|
|
<%= render "polls/questions/question", question: question, token: @token %>
|
|
<% end %>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="expanded poll-more-info">
|
|
<div class="row margin">
|
|
<div class="small-12 medium-9 column">
|
|
<h3><%= t("polls.show.more_info_title") %></h3>
|
|
<%= auto_link_already_sanitized_html simple_format(@poll.description) %>
|
|
</div>
|
|
|
|
<% if false %>
|
|
<aside class="small-12 medium-3 column">
|
|
<div class="sidebar-divider"></div>
|
|
<h2><%= t("polls.show.documents") %></h2>
|
|
</aside>
|
|
<% end %>
|
|
</div>
|
|
</div>
|
|
|
|
<div id="poll_more_info_answers" class="expanded poll-more-info-answers">
|
|
<div class="row padding">
|
|
<% @questions.each do |question| %>
|
|
<% if question.answers_with_read_more? %>
|
|
<div class="row question-divider">
|
|
<h2><%= question.title %></h2>
|
|
<% question.question_answers.visibles.each do |answer| %>
|
|
<% if answer.description.present? || answer.images.any? || answer.documents.present? || answer.videos.present? %>
|
|
<div class="small-12 medium-6 column margin-top margin-bottom" id="answer_<%= answer.id %>">
|
|
<h3><%= answer.title %></h3>
|
|
<div class="margin-top">
|
|
<div id="answer_description_<%= answer.id %>"
|
|
class="answer-description short answer-left-divider" data-toggler="short">
|
|
<% if answer.description.present? %>
|
|
<%= wysiwyg(answer.description) %>
|
|
<% end %>
|
|
|
|
<% if answer.images.any? %>
|
|
<div class="margin-top">
|
|
<%= render "gallery", answer: answer %>
|
|
</div>
|
|
<% end %>
|
|
|
|
<% if answer.documents.present? %>
|
|
<div class="document-link">
|
|
<p>
|
|
<span class="icon-document"></span>
|
|
<strong><%= t("polls.show.documents") %></strong>
|
|
</p>
|
|
<% answer.documents.each do |document| %>
|
|
<%= link_to document.title,
|
|
document.attachment.url,
|
|
target: "_blank",
|
|
rel: "nofollow" %>
|
|
<br>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
|
|
<% if answer.videos.present? %>
|
|
<div class="video-link">
|
|
<p>
|
|
<span class="icon-video"></span>
|
|
<strong><%= t("polls.show.videos") %></strong>
|
|
</p>
|
|
|
|
<% answer.videos.each do |video| %>
|
|
<%= link_to video.title,
|
|
video.url,
|
|
target: "_blank",
|
|
rel: "nofollow" %>
|
|
<br>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
<div class="margin-top margin-bottom">
|
|
<a id="read_more_<%= answer.id %>"
|
|
data-toggle="answer_description_<%= answer.id %>
|
|
read_more_<%= answer.id %> read_less_<%= answer.id %>"
|
|
data-toggler="hide">
|
|
<%= t("polls.show.read_more", answer: answer.title) %>
|
|
</a>
|
|
<a id="read_less_<%= answer.id %>"
|
|
data-toggle="answer_description_<%= answer.id %>
|
|
read_more_<%= answer.id %> read_less_<%= answer.id %>"
|
|
data-toggler="hide" class="hide">
|
|
<%= t("polls.show.read_less", answer: answer.title) %>
|
|
</a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<% end %>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
<% end %>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div class="tabs-content" data-tabs-content="polls_tabs">
|
|
<%= render "filter_subnav" %>
|
|
|
|
<div class="tabs-panel is-active" id="tab-comments">
|
|
<%= render "comments" %>
|
|
</div>
|
|
</div>
|
|
</div>
|