928312e218
Sometimes we're interpolating a link inside a translation, and marking the whole translations as HTML safe. However, some translations added by admins to the database or through crowdin are not entirely under our control. Although AFAIK crowdin checks for potential cross-site scripting attacks, it's a good practice to sanitize parts of a string potentially out of our control before marking the string as HTML safe.
58 lines
2.3 KiB
Plaintext
58 lines
2.3 KiB
Plaintext
<% reason = investment.reason_for_not_being_selectable_by(current_user) %>
|
|
<% voting_allowed = true unless reason.presence == :not_voting_allowed %>
|
|
<% user_voted_for = voted_for?(investment_votes, investment) %>
|
|
|
|
<div class="supports js-participation">
|
|
|
|
<span class="total-supports <%= "no-button" unless voting_allowed || user_voted_for %>">
|
|
<%= t("budgets.investments.investment.supports", count: investment.total_votes) %>
|
|
</span>
|
|
|
|
<div class="in-favor js-in-favor">
|
|
<% if user_voted_for %>
|
|
<div class="supported callout success">
|
|
<%= t("budgets.investments.investment.already_supported") %>
|
|
</div>
|
|
<% elsif investment.should_show_votes? %>
|
|
<%= link_to vote_url,
|
|
class: "button button-support small expanded",
|
|
title: t("budgets.investments.investment.support_title"),
|
|
method: "post",
|
|
remote: (display_support_alert?(investment) ? false : true),
|
|
data: (display_support_alert?(investment) ? {
|
|
confirm: t("budgets.investments.investment.confirm_group", count: investment.group.max_votable_headings) } : nil),
|
|
"aria-hidden" => css_for_aria_hidden(reason) do %>
|
|
<%= t("budgets.investments.investment.give_support") %>
|
|
<% end %>
|
|
<% end %>
|
|
</div>
|
|
|
|
<% if reason.present? && !user_voted_for %>
|
|
<div class="js-participation-not-allowed participation-not-allowed" style="display:none" aria-hidden="false">
|
|
<p>
|
|
<small>
|
|
<%= sanitize(t("votes.budget_investments.#{reason}",
|
|
count: investment.group.max_votable_headings,
|
|
verify_account: link_to_verify_account,
|
|
signin: link_to_signin,
|
|
signup: link_to_signup,
|
|
supported_headings: (current_user && current_user.headings_voted_within_group(investment.group).map(&:name).sort.to_sentence)
|
|
)) %>
|
|
</small>
|
|
</p>
|
|
</div>
|
|
<% end %>
|
|
|
|
<% if user_voted_for && setting["twitter_handle"] %>
|
|
<div class="share-supported">
|
|
<%= render "shared/social_share",
|
|
title: investment.title,
|
|
image_url: image_absolute_url(investment.image, :thumb),
|
|
url: budget_investment_url(investment.budget, investment),
|
|
description: investment.title,
|
|
mobile: investment.title
|
|
%>
|
|
</div>
|
|
<% end %>
|
|
</div>
|