Use _html suffix to avoid using raw when displaying translated strings

This is safer than raw, since any user input is still escaped.
This commit is contained in:
Andy Allan 2020-01-02 17:13:41 +01:00
parent dddef7672e
commit 8dba8cd4a0
7 changed files with 36 additions and 36 deletions

View file

@ -1,7 +1,7 @@
<li><%= linked_name = link_to h(printable_name(containing_relation.relation)), :action => "relation", :id => containing_relation.relation.id.to_s
if containing_relation.member_role.blank?
raw t ".entry", :relation_name => linked_name
t ".entry_html", :relation_name => linked_name
else
raw t ".entry_role", :relation_name => linked_name, :relation_role => h(containing_relation.member_role)
t ".entry_role_html", :relation_name => linked_name, :relation_role => h(containing_relation.member_role)
end %>
</li>

View file

@ -3,8 +3,8 @@
type_str = t ".type." + relation_member.member_type.downcase %>
<li class="<%= member_class %>">
<%= if relation_member.member_role.blank?
raw t ".entry", :type => type_str, :name => linked_name
t ".entry_html", :type => type_str, :name => linked_name
else
raw t ".entry_role", :type => type_str, :name => linked_name, :role => h(relation_member.member_role)
t ".entry_role_html", :type => type_str, :name => linked_name, :role => h(relation_member.member_role)
end %>
</li>

View file

@ -25,7 +25,7 @@
<%= link_to printable_name(wn.node), { :action => "node", :id => wn.node_id.to_s }, { :class => link_class("node", wn.node), :title => link_title(wn.node), :rel => link_follow(wn.node) } %>
<% related_ways = wn.node.ways.reject { |w| w.id == wn.way_id } %>
<% if related_ways.size > 0 then %>
(<%= raw t ".also_part_of", :count => related_ways.size, :related_ways => related_ways.map { |w| link_to(printable_name(w), { :action => "way", :id => w.id.to_s }, { :class => link_class("way", w), :title => link_title(w) }) }.to_sentence %>)
(<%= t ".also_part_of_html", :count => related_ways.size, :related_ways => to_sentence(related_ways.map { |w| link_to(printable_name(w), { :action => "way", :id => w.id.to_s }, { :class => link_class("way", w), :title => link_title(w) }) }) %>)
<% end %>
</li>
<% end %>

View file

@ -2,7 +2,7 @@
<h2>
<a class="geolink" href="<%= root_path %>"><span class="icon close"></span></a>
<%= raw t("browse.#{@type}.title", :name => printable_name(@feature)) %>
<%= t("browse.#{@type}.title_html", :name => printable_name(@feature)) %>
</h2>
<%= render :partial => @type, :object => @feature %>

View file

@ -5,7 +5,7 @@
<%= t("site.sidebar.search_results") %>
</h2>
<% @sources.each do |source| %>
<h4 class="inner12"><%= raw(t(".title.#{source}")) %></h4>
<h4 class="inner12"><%= t(".title.#{source}_html") %></h4>
<div class="search_results_entry" data-href="<%= url_for @params.merge(:action => "search_#{source}") %>">
<%= image_tag "searching.gif", :class => "loader" %>
</div>

View file

@ -6,14 +6,14 @@
<%= tag.h1 :lang => @locale, :dir => t("html.dir", :locale => @locale) do %>
<h1><%= t ".native.title" %></h1>
<p>
<%= raw t ".native.text",
:native_link => link_to(t(".native.native_link"),
:controller => "site",
:action => "copyright",
:copyright_locale => nil),
:mapping_link => link_to(t(".native.mapping_link"),
:controller => "site",
:action => "index") %>
<%= t ".native.html",
:native_link => link_to(t(".native.native_link"),
:controller => "site",
:action => "copyright",
:copyright_locale => nil),
:mapping_link => link_to(t(".native.mapping_link"),
:controller => "site",
:action => "index") %>
</p>
<% end %>
<hr />
@ -24,11 +24,11 @@
<% if t(".legal_babble", :locale => @locale) != t(".legal_babble", :locale => :en) %>
<h1><%= t ".foreign.title" %></h1>
<p>
<%= raw t ".foreign.text",
:english_original_link => link_to(t(".foreign.english_link"),
:controller => "site",
:action => "copyright",
:copyright_locale => "en") %>
<%= t ".foreign.html",
:english_original_link => link_to(t(".foreign.english_link"),
:controller => "site",
:action => "copyright",
:copyright_locale => "en") %>
</p>
<% end %>
<hr />