cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use _html suffix to avoid using raw when displaying translated strings

Browse source 
This is safer than raw, since any user input is still escaped.
This commit is contained in:
Andy Allan 2019-12-20 14:32:00 +01:00
parent dfedf85b6c
commit 217f616630
10 changed files with 31 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/views/site/about.html.erb
View file

@ -5,7 +5,7 @@
<div class='user-image'></div>
<h1><%= raw t ".used_by", :name => "<span class='user-name'>OpenStreetMap</span>" %></h1>
<h1><%= t ".used_by_html", :name => content_tag(:span, "OpenStreetMap", :class => "user-name") %></h1>
</div>
<div class='text'>