diff options
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/request_controller.rb | 3 | ||||
| -rw-r--r-- | app/controllers/track_controller.rb | 2 | ||||
| -rw-r--r-- | app/controllers/user_controller.rb | 4 | ||||
| -rw-r--r-- | app/views/general/blog.html.erb | 4 | ||||
| -rw-r--r-- | app/views/request/show.html.erb | 19 |
5 files changed, 18 insertions, 14 deletions
diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb index 413b74cea..39e7616ed 100644 --- a/app/controllers/request_controller.rb +++ b/app/controllers/request_controller.rb @@ -776,6 +776,9 @@ class RequestController < ApplicationController # Prevent spam to magic request address. Note that the binary # subsitution method used depends on the content type @incoming_message.apply_masks!(@attachment.body, @attachment.content_type) + if response.content_type == 'text/html' + @attachment.body = ActionController::Base.helpers.sanitize(@attachment.body) + end render :text => @attachment.body end diff --git a/app/controllers/track_controller.rb b/app/controllers/track_controller.rb index 7018af03c..4b272797f 100644 --- a/app/controllers/track_controller.rb +++ b/app/controllers/track_controller.rb @@ -211,7 +211,7 @@ class TrackController < ApplicationController track_thing.destroy end - redirect_to params[:r] + redirect_to URI.parse(params[:r]).path end diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index b7c8252f5..56f42891d 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -256,7 +256,7 @@ class UserController < ApplicationController def signout clear_session_credentials if params[:r] - redirect_to params[:r] + redirect_to URI.parse(params[:r]).path else redirect_to :controller => "general", :action => "frontpage" end @@ -596,7 +596,7 @@ class UserController < ApplicationController end @user.receive_email_alerts = params[:receive_email_alerts] @user.save! - redirect_to params[:came_from] + redirect_to URI.parse(params[:came_from]).path end private diff --git a/app/views/general/blog.html.erb b/app/views/general/blog.html.erb index 5dda7ab74..fd87bd9fe 100644 --- a/app/views/general/blog.html.erb +++ b/app/views/general/blog.html.erb @@ -10,9 +10,9 @@ <p class="subtitle"><%= _("Posted on {{date}} by {{author}}", :date=>simple_date(Time.parse(item['pubDate'][0])), :author=> item['creator'] ? item['creator'][0] : item['author'][0]) %></p> <div> <% if item['encoded'] %> - <%= raw item['encoded'][0] %> + <%= sanitize(raw item['encoded'][0]) %> <% elsif item['description'] %> - <%= raw item['description'][0] %> + <%= sanitize(raw item['description'][0]) %> <% end %> </div> <p><em> diff --git a/app/views/request/show.html.erb b/app/views/request/show.html.erb index 1383030cd..89a4c53b8 100644 --- a/app/views/request/show.html.erb +++ b/app/views/request/show.html.erb @@ -51,19 +51,20 @@ <p id="request_status" class="request_icon_line icon_<%= @info_request.calculate_status %>"> <% if @info_request.awaiting_description %> <% if @is_owning_user && !@info_request.is_external? && !@render_to_file %> - <%= _('Please <strong>answer the question above</strong> so we know whether the ')%> - <%= MySociety::Format.fancy_pluralize(@new_responses_count, 'recent response contains', 'recent responses contain') %> <%= _('useful information.') %> + <%= n_('Please <strong>answer the question above</strong> so we know whether the recent response contains useful information.', + 'Please <strong>answer the question above</strong> so we know whether the recent responses contain useful information.', + @new_responses_count) %> <% else %> <%= _('This request has an <strong>unknown status</strong>.') %> <% if @old_unclassified %> - <%= _('We\'re waiting for someone to read') %> - <%= MySociety::Format.fancy_pluralize(@new_responses_count, 'a recent response', 'recent responses') %> - <%= _('and update the status accordingly. Perhaps <strong>you</strong> might like to help out by doing that?') %> + <%= n_("We're waiting for someone to read a recent response and update the status accordingly. Perhaps <strong>you</strong> might like to help out by doing that?", + "We're waiting for someone to read recent responses and update the status accordingly. Perhaps <strong>you</strong> might like to help out by doing that?", + @new_responses_count) %> <% else %> - <%= _('We\'re waiting for') %> - <%= user_link_for_request(@info_request) %> <%= _('to read') %> - <%= MySociety::Format.fancy_pluralize(@new_responses_count, 'a recent response', 'recent responses') %> - <%= _('and update the status.') %> + <%= n_("We're waiting for {{user}} to read a recent response and update the status.", + "We're waiting for {{user}} to read recent responses and update the status.", + @new_responses_count, + :user => user_link_for_request(@info_request)) %> <% end %> <% end %> <% elsif @status == 'waiting_response' %> |