Merge remote-tracking branch 'openaustralia_github/rails_xss' into develop

1 files changed, 3 insertions, 3 deletions

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 6411cf27e..b9ba712a4 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -35,15 +35,15 @@ module ApplicationHelper
               end
           end
 
-          error_messages = []
+          error_messages = "".html_safe
           for object in objects
               object.errors.each do |attr, message|
-                  error_messages << content_tag(:li, message)
+                  error_messages << content_tag(:li, h(message))
               end
           end
 
           content_tag(:div,
-              content_tag(:ul, error_messages.join),
+              content_tag(:ul, error_messages),
             html
           )
         else