consul/nairobi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use sanitize instead of html_safe

Browse Source 
The difference is `html_safe` allows every HTML tag, including the
`<script>` tag, while `sanitize` only allows tags which are considered
safe. In this case, we want to allow a `<span>` tag in a translation,
and links inside flash messages.
This commit is contained in:
Javi Martín
2019-10-02 17:06:49 +02:00
parent 928312e218
commit 61bf9a5c73
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/budgets/ballot/_ballot.html.erb
View File

@@ -26,8 +26,8 @@
<h3> <h3>
<%= group.name %> - <%= @ballot.heading_for_group(group).name %> <%= group.name %> - <%= @ballot.heading_for_group(group).name %>
</h3> </h3>
<%= link_to t("budgets.ballots.show.remaining", <%= link_to sanitize(t("budgets.ballots.show.remaining",
amount: @ballot.formatted_amount_available(@ballot.heading_for_group(group))).html_safe, amount: @ballot.formatted_amount_available(@ballot.heading_for_group(group)))),
budget_group_path(@budget, group) %> budget_group_path(@budget, group) %>
</div> </div>
<% if @ballot.has_lines_in_group?(group) %> <% if @ballot.has_lines_in_group?(group) %>

2
app/views/kaminari/_gap.html.erb
View File

@@ -1,3 +1,3 @@
<li class="ellipsis" aria-hidden="true"> <li class="ellipsis" aria-hidden="true">
<%= t("views.pagination.truncate").html_safe %> <%= sanitize(t("views.pagination.truncate")) %>
</li> </li>

2
app/views/layouts/_flash.html.erb
View File

@@ -5,7 +5,7 @@
<span aria-hidden="true">&times;</span> <span aria-hidden="true">&times;</span>
</button> </button>
<div class="notice-text"> <div class="notice-text">
<%= flash_message.try(:html_safe) %> <%= sanitize(flash_message) %>
</div> </div>
</div> </div>
</div> </div>