Sanitize translations instead of using _html
Using the `_html` suffix in an i18n key is the same as using `html_safe` on it, which means that translation could potentially be used for XSS attacks.
This commit is contained in:
@@ -18,7 +18,9 @@
|
||||
<p>
|
||||
<%= page_entries_info @debates %>
|
||||
<% if !@advanced_search_terms %>
|
||||
<%= t("debates.index.search_results_html", count: @debates.size, search_term: @search_terms) %>
|
||||
<%= sanitize(
|
||||
t("debates.index.search_results", count: @debates.size, search_term: @search_terms)
|
||||
) %>
|
||||
<% end %>
|
||||
</p>
|
||||
<% elsif @tag_filter %>
|
||||
|
||||
Reference in New Issue
Block a user