Sanitize translations instead of using _html
Using the `_html` suffix in an i18n key is the same as using `html_safe` on it, which means that translation could potentially be used for XSS attacks.
This commit is contained in:
@@ -64,7 +64,7 @@ module GlobalizeHelper
|
||||
end
|
||||
|
||||
def selected_languages_description(resource)
|
||||
t("shared.translations.languages_in_use_html", count: active_languages_count(resource))
|
||||
sanitize(t("shared.translations.languages_in_use", count: active_languages_count(resource)))
|
||||
end
|
||||
|
||||
def select_language_error(resource)
|
||||
|
||||
Reference in New Issue
Block a user