Use _html suffix to avoid using raw when displaying translated strings

This is safer than raw, since any user input is still escaped.

diff --git a/app/views/browse/_containing_relation.html.erb b/app/views/browse/_containing_relation.html.erb
index b3cb90cec2aa4a7d05b705c1c2745b6f59237a23..ba05c1fe427471e805464e210fe4719df3921746 100644 (file)
--- a/app/views/browse/_containing_relation.html.erb
+++ b/app/views/browse/_containing_relation.html.erb
@@ -1,7 +1,7 @@
 <li><%= linked_name = link_to h(printable_name(containing_relation.relation)), :action => "relation", :id => containing_relation.relation.id.to_s
         if containing_relation.member_role.blank?
-          raw t ".entry", :relation_name => linked_name
+          t ".entry_html", :relation_name => linked_name
         else
-          raw t ".entry_role", :relation_name => linked_name, :relation_role => h(containing_relation.member_role)
+          t ".entry_role_html", :relation_name => linked_name, :relation_role => h(containing_relation.member_role)
         end %>
 </li>

diff --git a/app/views/browse/_relation_member.html.erb b/app/views/browse/_relation_member.html.erb
index bb37bdf210a5c7ee89ee6c792e9e01a37af474c2..fe0f363574e0e0904023d4bc1c91f08aa617b16d 100644 (file)
--- a/app/views/browse/_relation_member.html.erb
+++ b/app/views/browse/_relation_member.html.erb
@@ -3,8 +3,8 @@
    type_str = t ".type." + relation_member.member_type.downcase %>
 <li class="<%= member_class %>">
   <%= if relation_member.member_role.blank?
-        raw t ".entry", :type => type_str, :name => linked_name
+        t ".entry_html", :type => type_str, :name => linked_name
       else
-        raw t ".entry_role", :type => type_str, :name => linked_name, :role => h(relation_member.member_role)
+        t ".entry_role_html", :type => type_str, :name => linked_name, :role => h(relation_member.member_role)
       end %>
 </li>

diff --git a/app/views/browse/_way.html.erb b/app/views/browse/_way.html.erb
index ed206c59bcc7399f803a2bca50e1882ccff569c1..5560344a86e9dd4b733aa4bd68436a1803abfac4 100644 (file)
--- a/app/views/browse/_way.html.erb
+++ b/app/views/browse/_way.html.erb
@@ -25,7 +25,7 @@
             <%= link_to printable_name(wn.node), { :action => "node", :id => wn.node_id.to_s }, { :class => link_class("node", wn.node), :title => link_title(wn.node), :rel => link_follow(wn.node) } %>
             <% related_ways = wn.node.ways.reject { |w| w.id == wn.way_id } %>
             <% if related_ways.size > 0 then %>
-              (<%= raw t ".also_part_of", :count => related_ways.size, :related_ways => related_ways.map { |w| link_to(printable_name(w), { :action => "way", :id => w.id.to_s }, { :class => link_class("way", w), :title => link_title(w) }) }.to_sentence %>)
+              (<%= t ".also_part_of_html", :count => related_ways.size, :related_ways => to_sentence(related_ways.map { |w| link_to(printable_name(w), { :action => "way", :id => w.id.to_s }, { :class => link_class("way", w), :title => link_title(w) }) }) %>)
             <% end %>
           </li>
         <% end %>

diff --git a/app/views/browse/feature.html.erb b/app/views/browse/feature.html.erb
index 6c94b0a9dfd50aa8dab39c5ec33611c29c4abd2e..7dfccb29053ba60f51eebd77be9351b5dfb1c0ef 100644 (file)
--- a/app/views/browse/feature.html.erb
+++ b/app/views/browse/feature.html.erb
@@ -2,7 +2,7 @@
 
 <h2>
   <a class="geolink" href="<%= root_path %>"><span class="icon close"></span></a>
-  <%= raw t("browse.#{@type}.title", :name => printable_name(@feature)) %>
+  <%= t("browse.#{@type}.title_html", :name => printable_name(@feature)) %>
 </h2>
 
 <%= render :partial => @type, :object => @feature %>

diff --git a/app/views/geocoder/search.html.erb b/app/views/geocoder/search.html.erb
index 3eb9561a2d2105a7d3ec0443de412f3739532dc6..13144d568eda6306a3f0345278669f9c2fa3f6a0 100644 (file)
--- a/app/views/geocoder/search.html.erb
+++ b/app/views/geocoder/search.html.erb
@@ -5,7 +5,7 @@
     <%= t("site.sidebar.search_results") %>
 </h2>
 <% @sources.each do |source| %>
-  <h4 class="inner12"><%= raw(t(".title.#{source}")) %></h4>
+  <h4 class="inner12"><%= t(".title.#{source}_html") %></h4>
   <div class="search_results_entry" data-href="<%= url_for @params.merge(:action => "search_#{source}") %>">
     <%= image_tag "searching.gif", :class => "loader" %>
   </div>

diff --git a/app/views/site/copyright.html.erb b/app/views/site/copyright.html.erb
index feec81c82172053f7921bbd8d537772c58647d1d..c6a0348df001f658ab014e6d3c0d27fbda00a92d 100644 (file)
--- a/app/views/site/copyright.html.erb
+++ b/app/views/site/copyright.html.erb
@@ -6,14 +6,14 @@
       <%= tag.h1 :lang => @locale, :dir => t("html.dir", :locale => @locale) do %>
         <h1><%= t ".native.title" %></h1>
         <p>
-          <%= raw t ".native.text",
-                    :native_link => link_to(t(".native.native_link"),
-                                            :controller => "site",
-                                            :action => "copyright",
-                                            :copyright_locale => nil),
-                    :mapping_link => link_to(t(".native.mapping_link"),
-                                             :controller => "site",
-                                             :action => "index") %>
+          <%= t ".native.html",
+              :native_link => link_to(t(".native.native_link"),
+                                      :controller => "site",
+                                      :action => "copyright",
+                                      :copyright_locale => nil),
+              :mapping_link => link_to(t(".native.mapping_link"),
+                                       :controller => "site",
+                                       :action => "index") %>
         </p>
       <% end %>
       <hr />
@@ -24,11 +24,11 @@
       <% if t(".legal_babble", :locale => @locale) != t(".legal_babble", :locale => :en) %>
         <h1><%= t ".foreign.title" %></h1>
         <p>
-          <%= raw t ".foreign.text",
-                    :english_original_link => link_to(t(".foreign.english_link"),
-                                                      :controller => "site",
-                                                      :action => "copyright",
-                                                      :copyright_locale => "en") %>
+          <%= t ".foreign.html",
+              :english_original_link => link_to(t(".foreign.english_link"),
+                                                :controller => "site",
+                                                :action => "copyright",
+                                                :copyright_locale => "en") %>
         </p>
       <% end %>
       <hr />

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 9e2e6dbb7354c581a1d4d6d9f1d2e210eecb7d41..31531a656e480943ed02b8e466bea2ca7e41d894 100644 (file)
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -221,29 +221,29 @@ en:
       discussion: Discussion
       still_open: "Changeset still open - discussion will open once the changeset is closed."
     node:
-      title: "Node: %{name}"
+      title_html: "Node: %{name}"
       history_title: "Node History: %{name}"
     way:
-      title: "Way: %{name}"
+      title_html: "Way: %{name}"
       history_title: "Way History: %{name}"
       nodes: "Nodes"
-      also_part_of:
+      also_part_of_html:
         one: "part of way %{related_ways}"
         other: "part of ways %{related_ways}"
     relation:
-      title: "Relation: %{name}"
+      title_html: "Relation: %{name}"
       history_title: "Relation History: %{name}"
       members: "Members"
     relation_member:
-      entry: "%{type} %{name}"
-      entry_role: "%{type} %{name} as %{role}"
+      entry_html: "%{type} %{name}"
+      entry_role_html: "%{type} %{name} as %{role}"
       type:
         node: "Node"
         way: "Way"
         relation: "Relation"
     containing_relation:
-      entry: "Relation %{relation_name}"
-      entry_role: "Relation %{relation_name} (as %{relation_role})"
+      entry_html: "Relation %{relation_name}"
+      entry_role_html: "Relation %{relation_name} (as %{relation_role})"
     not_found:
       sorry: "Sorry, %{type} #%{id} could not be found."
       type:
@@ -422,12 +422,12 @@ en:
   geocoder:
     search:
       title:
-        latlon: 'Results from <a href="https://openstreetmap.org/">Internal</a>'
-        ca_postcode: 'Results from <a href="https://geocoder.ca/">Geocoder.CA</a>'
-        osm_nominatim: 'Results from <a href="https://nominatim.openstreetmap.org/">OpenStreetMap Nominatim</a>'
-        geonames: 'Results from <a href="http://www.geonames.org/">GeoNames</a>'
-        osm_nominatim_reverse: 'Results from <a href="https://nominatim.openstreetmap.org/">OpenStreetMap Nominatim</a>'
-        geonames_reverse: 'Results from <a href="http://www.geonames.org/">GeoNames</a>'
+        latlon_html: 'Results from <a href="https://openstreetmap.org/">Internal</a>'
+        ca_postcode_html: 'Results from <a href="https://geocoder.ca/">Geocoder.CA</a>'
+        osm_nominatim_html: 'Results from <a href="https://nominatim.openstreetmap.org/">OpenStreetMap Nominatim</a>'
+        geonames_html: 'Results from <a href="http://www.geonames.org/">GeoNames</a>'
+        osm_nominatim_reverse_html: 'Results from <a href="https://nominatim.openstreetmap.org/">OpenStreetMap Nominatim</a>'
+        geonames_reverse_html: 'Results from <a href="http://www.geonames.org/">GeoNames</a>'
     search_osm_nominatim:
       prefix_format: "%{name}"
       prefix:
@@ -1373,11 +1373,11 @@ en:
     copyright:
       foreign:
         title: About this translation
-        text: In the event of a conflict between this translated page and %{english_original_link}, the English page shall take precedence
+        html: In the event of a conflict between this translated page and %{english_original_link}, the English page shall take precedence
         english_link: the English original
       native:
         title: About this page
-        text: You are viewing the English version of the copyright page. You can go back to the %{native_link} of this page or you can stop reading about copyright and %{mapping_link}.
+        html: You are viewing the English version of the copyright page. You can go back to the %{native_link} of this page or you can stop reading about copyright and %{mapping_link}.
         native_link: THIS_LANGUAGE_NAME_HERE version
         mapping_link: start mapping
       legal_babble: