Use _html suffix to avoid using raw when displaying translated strings

This is safer than raw, since any user input is still escaped.
This commit is contained in:
Andy Allan 2020-01-02 17:43:34 +01:00
parent 8dba8cd4a0
commit 5aa255e13f
7 changed files with 21 additions and 20 deletions

View file

@ -2,7 +2,7 @@
<h2>
<a class="geolink" href="<%= root_path %>"><span class="icon close"></span></a>
<%= raw t("browse.#{@type}.history_title", :name => printable_name(@feature)) %>
<%= t("browse.#{@type}.history_title_html", :name => printable_name(@feature)) %>
</h2>
<%= render :partial => @type, :collection => @feature.send("old_#{@type}s").reverse %>