Sanitize any user supplied HTML before doing link detection or the

[rails.git] / app / helpers / application_helper.rb

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index bee4f9ce2f4dc5a6ec30ab8fb90b816675da3860..e10650ada1fa3cde95956725f5e679f146446156 100644 (file)
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -1,6 +1,14 @@
 module ApplicationHelper
   def htmlize(text)
-    return sanitize(auto_link(simple_format(text), :urls))
+    return auto_link(sanitize(simple_format(text)), :link => :urls, :html => { :rel => "nofollow" })
+  end
+
+  def html_escape_unicode(text)
+    chars = ActiveSupport::Multibyte::Chars.u_unpack(text).map do |c|
+      c < 127 ? c.chr : "&##{c.to_s};"
+    end
+
+    return chars.join("")
   end
 
   def rss_link_to(*args)