diff --git a/app/views/budgets/investments/_form.html.erb b/app/views/budgets/investments/_form.html.erb index e080f2ede..138743669 100644 --- a/app/views/budgets/investments/_form.html.erb +++ b/app/views/budgets/investments/_form.html.erb @@ -93,7 +93,8 @@ title: t("form.accept_terms_title"), label: t("form.accept_terms", policy: link_to(t("form.policy"), "/privacy", target: "blank"), - conditions: link_to(t("form.conditions"), "/conditions", target: "blank")).html_safe %> + conditions: link_to(t("form.conditions"), "/conditions", target: "blank") + ) %> <% end %> diff --git a/app/views/debates/_form.html.erb b/app/views/debates/_form.html.erb index d74e08272..38b4e2bcc 100644 --- a/app/views/debates/_form.html.erb +++ b/app/views/debates/_form.html.erb @@ -39,7 +39,7 @@ label: t("form.accept_terms", policy: link_to(t("form.policy"), "/privacy", target: "blank"), conditions: link_to(t("form.conditions"), "/conditions", target: "blank") - ).html_safe %> + ) %> <% end %> diff --git a/app/views/legislation/proposals/_form.html.erb b/app/views/legislation/proposals/_form.html.erb index 052aa7186..d0c387482 100644 --- a/app/views/legislation/proposals/_form.html.erb +++ b/app/views/legislation/proposals/_form.html.erb @@ -65,7 +65,7 @@ label: t("form.accept_terms", policy: link_to(t("form.policy"), "/privacy", target: "blank"), conditions: link_to(t("form.conditions"), "/conditions", target: "blank") - ).html_safe %> + ) %> <% end %> diff --git a/app/views/organizations/registrations/new.html.erb b/app/views/organizations/registrations/new.html.erb index f9100fec6..1f6b4b22e 100644 --- a/app/views/organizations/registrations/new.html.erb +++ b/app/views/organizations/registrations/new.html.erb @@ -34,7 +34,7 @@ "/conditions", title: t("shared.target_blank"), target: "_blank") - ).html_safe %> + ) %>
<%= f.submit t("devise_views.organizations.registrations.new.submit"), class: "button expanded" %> diff --git a/app/views/proposals/_form.html.erb b/app/views/proposals/_form.html.erb index c2913ec90..6f2a34e82 100644 --- a/app/views/proposals/_form.html.erb +++ b/app/views/proposals/_form.html.erb @@ -100,7 +100,7 @@ label: t("form.accept_terms", policy: link_to(t("form.policy"), "/privacy", target: "blank"), conditions: link_to(t("form.conditions"), "/conditions", target: "blank") - ).html_safe %> + ) %> <% end %>
diff --git a/app/views/users/registrations/new.html.erb b/app/views/users/registrations/new.html.erb index de50cc265..c01556c42 100644 --- a/app/views/users/registrations/new.html.erb +++ b/app/views/users/registrations/new.html.erb @@ -42,7 +42,7 @@ terms: link_to(t("devise_views.users.registrations.new.terms_link"), "/conditions", title: t("shared.target_blank"), target: "_blank") - ).html_safe %> + ) %>
<%= f.submit t("devise_views.users.registrations.new.submit"), class: "button expanded" %> diff --git a/app/views/verification/residence/new.html.erb b/app/views/verification/residence/new.html.erb index 6933f94f9..8f6d453c6 100644 --- a/app/views/verification/residence/new.html.erb +++ b/app/views/verification/residence/new.html.erb @@ -80,7 +80,7 @@ terms_url: link_to(t("verification.residence.new.terms"), "/census_terms", title: t("shared.target_blank"), target: "_blank") - ).html_safe %> + ) %>
diff --git a/lib/consul_form_builder.rb b/lib/consul_form_builder.rb index 9cf822823..2433e867d 100644 --- a/lib/consul_form_builder.rb +++ b/lib/consul_form_builder.rb @@ -1,4 +1,6 @@ class ConsulFormBuilder < FoundationRailsHelper::FormBuilder + include ActionView::Helpers::SanitizeHelper + def enum_select(attribute, options = {}, html_options = {}) choices = object.class.send(attribute.to_s.pluralize).keys.map do |name| [object.class.human_attribute_name("#{attribute}.#{name}"), name] @@ -35,6 +37,14 @@ class ConsulFormBuilder < FoundationRailsHelper::FormBuilder private + def custom_label(attribute, text, options) + if text == false + super + else + super(attribute, sanitize(label_text(object, attribute, text)), options) + end + end + def label_with_hint(attribute, options) custom_label(attribute, options[:label], options[:label_options]) + help_text(attribute, options) diff --git a/spec/features/xss_spec.rb b/spec/features/xss_spec.rb index 7f3d81ab1..d75564c33 100644 --- a/spec/features/xss_spec.rb +++ b/spec/features/xss_spec.rb @@ -31,6 +31,15 @@ describe "Cross-Site Scripting protection", :js do expect(page.text).not_to be_empty end + scenario "accept terms label" do + I18nContent.create(key: "form.accept_terms", value: attack_code) + + login_as(create(:user)) + visit new_debate_path + + expect(page.text).not_to be_empty + end + scenario "proposal actions in dashboard" do proposal = create(:proposal)