cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use hash-based flash objects to render complex flash messages

Browse source 
Since flash objects can only be String, Hash or Array (notably excluding SafeBuffers), then this approach is necessary to render complex html in a safe manner.

Each local can be treated as an (unsafe) string, and therefore escaped normally when rendered into the template. The template (and translation strings) can
contain html since they are no longer stored in the flash as a plain string.

Fixes #3215
This commit is contained in:
Andy Allan 2021-06-23 16:26:50 +01:00
parent f6818bb2ed
commit 24f6aeda6a
6 changed files with 43 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
app/helpers/application_helper.rb
View file

@ -68,4 +68,14 @@ module ApplicationHelper
data
end
# If the flash is a hash, then it will be a partial with a hash of locals, so we can call `render` on that
# This allows us to render html into a flash message in a safe manner.
def render_flash(flash)
if flash.is_a?(Hash)
render flash.with_indifferent_access
else
flash
end
end
end