Files
nairobi/app/views/documents/_nested_documents.html.erb
Javi Martín 6b1864fbcd Sanitize translations instead of using _html
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
2019-10-09 19:46:47 +02:00

24 lines
1.2 KiB
Plaintext

<div class="documents-list">
<%= f.label :documents, t("documents.form.title") %>
<p class="help-text"><%= documentables_note(documentable) %></p>
<div id="nested-documents" data-max-documents-allowed="<%= documentable.class.max_documents_allowed %>">
<%= f.fields_for :documents do |documents_builder| %>
<%= render "documents/document_fields", f: documents_builder %>
<% end %>
</div>
<%= link_to_add_association t("documents.form.add_new_document"), f, :documents,
partial: "documents/document_fields",
id: "new_document_link",
class: "button hollow #{"hide" if documentable.documents.count >= documentable.class.max_documents_allowed}",
data: {
association_insertion_node: "#nested-documents",
association_insertion_method: "append"
} %>
<div id="max-documents-notice" class="max-documents-notice callout primary text-center <%= "hide" unless max_documents_allowed?(documentable) %>">
<%= sanitize(t("documents.max_documents_allowed_reached")) %>
</div>
</div>