diff --git a/app/views/budgets/investments/_form.html.erb b/app/views/budgets/investments/_form.html.erb
index e080f2ede..138743669 100644
--- a/app/views/budgets/investments/_form.html.erb
+++ b/app/views/budgets/investments/_form.html.erb
@@ -93,7 +93,8 @@
title: t("form.accept_terms_title"),
label: t("form.accept_terms",
policy: link_to(t("form.policy"), "/privacy", target: "blank"),
- conditions: link_to(t("form.conditions"), "/conditions", target: "blank")).html_safe %>
+ conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
+ ) %>
<% end %>
diff --git a/app/views/debates/_form.html.erb b/app/views/debates/_form.html.erb
index d74e08272..38b4e2bcc 100644
--- a/app/views/debates/_form.html.erb
+++ b/app/views/debates/_form.html.erb
@@ -39,7 +39,7 @@
label: t("form.accept_terms",
policy: link_to(t("form.policy"), "/privacy", target: "blank"),
conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
- ).html_safe %>
+ ) %>
<% end %>
diff --git a/app/views/legislation/proposals/_form.html.erb b/app/views/legislation/proposals/_form.html.erb
index 052aa7186..d0c387482 100644
--- a/app/views/legislation/proposals/_form.html.erb
+++ b/app/views/legislation/proposals/_form.html.erb
@@ -65,7 +65,7 @@
label: t("form.accept_terms",
policy: link_to(t("form.policy"), "/privacy", target: "blank"),
conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
- ).html_safe %>
+ ) %>
<% end %>
diff --git a/app/views/organizations/registrations/new.html.erb b/app/views/organizations/registrations/new.html.erb
index f9100fec6..1f6b4b22e 100644
--- a/app/views/organizations/registrations/new.html.erb
+++ b/app/views/organizations/registrations/new.html.erb
@@ -34,7 +34,7 @@
"/conditions",
title: t("shared.target_blank"),
target: "_blank")
- ).html_safe %>
+ ) %>
<%= f.submit t("devise_views.organizations.registrations.new.submit"), class: "button expanded" %>
diff --git a/app/views/proposals/_form.html.erb b/app/views/proposals/_form.html.erb
index c2913ec90..6f2a34e82 100644
--- a/app/views/proposals/_form.html.erb
+++ b/app/views/proposals/_form.html.erb
@@ -100,7 +100,7 @@
label: t("form.accept_terms",
policy: link_to(t("form.policy"), "/privacy", target: "blank"),
conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
- ).html_safe %>
+ ) %>
<% end %>
diff --git a/app/views/users/registrations/new.html.erb b/app/views/users/registrations/new.html.erb
index de50cc265..c01556c42 100644
--- a/app/views/users/registrations/new.html.erb
+++ b/app/views/users/registrations/new.html.erb
@@ -42,7 +42,7 @@
terms: link_to(t("devise_views.users.registrations.new.terms_link"), "/conditions",
title: t("shared.target_blank"),
target: "_blank")
- ).html_safe %>
+ ) %>
<%= f.submit t("devise_views.users.registrations.new.submit"), class: "button expanded" %>
diff --git a/app/views/verification/residence/new.html.erb b/app/views/verification/residence/new.html.erb
index 6933f94f9..8f6d453c6 100644
--- a/app/views/verification/residence/new.html.erb
+++ b/app/views/verification/residence/new.html.erb
@@ -80,7 +80,7 @@
terms_url: link_to(t("verification.residence.new.terms"), "/census_terms",
title: t("shared.target_blank"),
target: "_blank")
- ).html_safe %>
+ ) %>
diff --git a/lib/consul_form_builder.rb b/lib/consul_form_builder.rb
index 9cf822823..2433e867d 100644
--- a/lib/consul_form_builder.rb
+++ b/lib/consul_form_builder.rb
@@ -1,4 +1,6 @@
class ConsulFormBuilder < FoundationRailsHelper::FormBuilder
+ include ActionView::Helpers::SanitizeHelper
+
def enum_select(attribute, options = {}, html_options = {})
choices = object.class.send(attribute.to_s.pluralize).keys.map do |name|
[object.class.human_attribute_name("#{attribute}.#{name}"), name]
@@ -35,6 +37,14 @@ class ConsulFormBuilder < FoundationRailsHelper::FormBuilder
private
+ def custom_label(attribute, text, options)
+ if text == false
+ super
+ else
+ super(attribute, sanitize(label_text(object, attribute, text)), options)
+ end
+ end
+
def label_with_hint(attribute, options)
custom_label(attribute, options[:label], options[:label_options]) +
help_text(attribute, options)
diff --git a/spec/features/xss_spec.rb b/spec/features/xss_spec.rb
index 7f3d81ab1..d75564c33 100644
--- a/spec/features/xss_spec.rb
+++ b/spec/features/xss_spec.rb
@@ -31,6 +31,15 @@ describe "Cross-Site Scripting protection", :js do
expect(page.text).not_to be_empty
end
+ scenario "accept terms label" do
+ I18nContent.create(key: "form.accept_terms", value: attack_code)
+
+ login_as(create(:user))
+ visit new_debate_path
+
+ expect(page.text).not_to be_empty
+ end
+
scenario "proposal actions in dashboard" do
proposal = create(:proposal)