[Fix #592] mutualize sanitize and clean flash messages

app/controllers/admin/gestionnaires_controller.rb

@@ -48,7 +48,7 @@ class Admin::GestionnairesController < AdminController
       flash.notice = 'Accompagnateur ajouté'
       GestionnaireMailer.new_gestionnaire(@gestionnaire.email, @gestionnaire.password).deliver_now!
     else
-      flash.alert = @gestionnaire.errors.full_messages.join('<br />').html_safe
+      flash.alert = @gestionnaire.errors.full_messages
     end
   end
 

app/controllers/admin/procedures_controller.rb

@@ -71,7 +71,7 @@ class Admin::ProceduresController < AdminController
     @procedure.module_api_carto = ModuleAPICarto.new(create_module_api_carto_params) if @procedure.valid?
 
     unless @procedure.save
-      flash.now.alert = @procedure.errors.full_messages.join('<br />').html_safe
+      flash.now.alert = @procedure.errors.full_messages
       return render 'new'
     end
 
@@ -83,7 +83,7 @@ class Admin::ProceduresController < AdminController
     @procedure = current_administrateur.procedures.find(params[:id])
 
     unless @procedure.update_attributes(procedure_params)
-      flash.now.alert = @procedure.errors.full_messages.join('<br />').html_safe
+      flash.now.alert = @procedure.errors.full_messages
       return render 'edit'
     end
 
@@ -166,7 +166,7 @@ class Admin::ProceduresController < AdminController
       flash.notice = 'Procédure clonée'
       redirect_to edit_admin_procedure_path(id: new_procedure.id)
     else
-      flash.now.alert = procedure.errors.full_messages.join('<br />').html_safe
+      flash.now.alert = procedure.errors.full_messages
       render 'index'
     end
 

app/controllers/administrations_controller.rb

@@ -20,7 +20,7 @@ class AdministrationsController < ApplicationController
       flash.notice = "Administrateur créé"
       NewAdminMailer.new_admin_email(admin).deliver_now!
     else
-      flash.alert = admin.errors.full_messages.join('<br>').html_safe
+      flash.alert = admin.errors.full_messages
     end
 
     redirect_to administrations_path

app/controllers/commentaires_controller.rb

@@ -32,7 +32,7 @@ class CommentairesController < ApplicationController
       if pj.errors.empty?
         @commentaire.piece_justificative = pj
       else
-        flash.alert = pj.errors.full_messages.join("<br>").html_safe
+        flash.alert = pj.errors.full_messages
       end
     end
 

app/controllers/invites_controller.rb

@@ -18,7 +18,7 @@ class InvitesController < ApplicationController
 
       flash.notice = "Invitation envoyée (#{invite.email})"
     else
-      flash.alert = invite.errors.full_messages.join('<br />').html_safe
+      flash.alert = invite.errors.full_messages
     end
 
     if gestionnaire_signed_in?

app/controllers/users/description_controller.rb

@@ -69,16 +69,16 @@ class Users::DescriptionController < UsersController
       unless params[:cerfa_pdf].nil?
         cerfa = Cerfa.new(content: params[:cerfa_pdf], dossier: @dossier, user: current_user)
         unless cerfa.save
-          flash.alert = cerfa.errors.full_messages.join('<br />').html_safe
+          flash.alert = cerfa.errors.full_messages
         end
       end
     end
 
     if !((errors_upload = PiecesJustificativesService.upload!(@dossier, current_user, params)).empty?)
       if flash.alert.nil?
-        flash.alert = errors_upload.join('<br>').html_safe
+        flash.alert = errors_upload
       else
-        flash.alert = (flash.alert + '<br />' + errors_upload.join('<br>').html_safe).html_safe
+        flash.alert = [flash.alert] + errors_upload
       end
 
     else
@@ -100,7 +100,7 @@ class Users::DescriptionController < UsersController
   private
 
   def redirect_to_description_with_errors(dossier, errors)
-    flash.alert = errors.join('<br>')
+    flash.alert = errors
     redirect_to users_dossier_description_path(dossier_id: dossier.id)
   end
 

app/controllers/users/dossiers_controller.rb

@@ -133,7 +133,7 @@ class Users::DossiersController < UsersController
 
     if checked_autorisation_donnees?
       unless Dossier.find(@facade.dossier.id).update_attributes update_params_with_formatted_birthdate
-        flash.alert = @facade.dossier.errors.full_messages.join('<br />').html_safe
+        flash.alert = @facade.dossier.errors.full_messages
 
         return redirect_to users_dossier_path(id: @facade.dossier.id)
       end

app/views/layouts/_flash_messages.html.haml

@@ -4,8 +4,8 @@
       - if value.class == Array
         .alert{ class: flash_class(key) }
           - value.each do |message|
-            = message
+            = sanitize(message)
             %br
       - else
         .alert{ class: flash_class(key) }
-          = value
+          = sanitize(value)