db1ccb18c7
The name `html_safe` is very confusing, and many developers (including me a few years ago) think what that method does is convert the HTML contents to safe content. It's actually quite the opposite: it marks the string as safe, so the HTML inside it isn't stripped out by Rails. In some cases we were marking strings as safe because we wanted to add some HTML. However, it meant the whole string was considered safe, and not just the contents which were under our control. In particular, some translations added by admins to the database or through crowding were marked as safe, when it wasn't necessarily the case. Although AFAIK crowdin checks for potential cross-site scripting attacks, it's a good practice to sanitize parts of a string potentially out of our control before marking the string as HTML safe.
61 lines
2.4 KiB
Ruby
61 lines
2.4 KiB
Ruby
module DocumentsHelper
|
|
|
|
def document_attachment_file_name(document)
|
|
document.attachment_file_name
|
|
end
|
|
|
|
def document_errors_on_attachment(document)
|
|
document.errors[:attachment].join(", ") if document.errors.key?(:attachment)
|
|
end
|
|
|
|
def bytes_to_mega(bytes)
|
|
bytes / Numeric::MEGABYTE
|
|
end
|
|
|
|
def document_nested_field_wrapper_id(index)
|
|
"document_#{index}"
|
|
end
|
|
|
|
def render_destroy_document_link(builder, document)
|
|
if !document.persisted? && document.cached_attachment.present?
|
|
link_to t("documents.form.delete_button"),
|
|
direct_upload_destroy_url("direct_upload[resource_type]": document.documentable_type,
|
|
"direct_upload[resource_id]": document.documentable_id,
|
|
"direct_upload[resource_relation]": "documents",
|
|
"direct_upload[cached_attachment]": document.cached_attachment),
|
|
method: :delete,
|
|
remote: true,
|
|
class: "delete remove-cached-attachment"
|
|
else
|
|
link_to_remove_association document.new_record? ? t("documents.form.cancel_button") : t("documents.form.delete_button"), builder, class: "delete remove-document"
|
|
end
|
|
end
|
|
|
|
def render_attachment(builder, document)
|
|
klass = document.persisted? || document.cached_attachment.present? ? " hide" : ""
|
|
builder.file_field :attachment,
|
|
label_options: { class: "button hollow #{klass}" },
|
|
accept: accepted_content_types_extensions(document.documentable_type.constantize),
|
|
class: "js-document-attachment",
|
|
data: {
|
|
url: document_direct_upload_url(document),
|
|
nested_document: true
|
|
}
|
|
end
|
|
|
|
def document_direct_upload_url(document)
|
|
direct_uploads_url("direct_upload[resource_type]": document.documentable_type,
|
|
"direct_upload[resource_id]": document.documentable_id,
|
|
"direct_upload[resource_relation]": "documents")
|
|
end
|
|
|
|
def document_item_link(document)
|
|
info_text = "#{document.humanized_content_type} | #{number_to_human_size(document.attachment_file_size)}"
|
|
|
|
link_to safe_join([document.title, content_tag(:small, "(#{info_text})")], " "),
|
|
document.attachment.url,
|
|
target: "_blank",
|
|
title: t("shared.target_blank")
|
|
end
|
|
end
|