Mark some strings that shouldn't be escaped as raw

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 6e2ecd3234fcf1c68a5ba72284483a6899288153..b2ce9b003f42082480736495006e46591f15b8e3 100644 (file)
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -37,7 +37,7 @@ module ApplicationHelper
     js << javascript_strings_for_key("javascripts")
     js << "</script>\n"
 
-    return js
+    return raw(js)
   end
 
   def style_rules

diff --git a/app/helpers/geocoder_helper.rb b/app/helpers/geocoder_helper.rb
index 8cbf4e9652bc804280c07de367b1e022867c7b62..082f9e5304180aed93ed6a01f359f65debc4158c 100644 (file)
--- a/app/helpers/geocoder_helper.rb
+++ b/app/helpers/geocoder_helper.rb
@@ -3,9 +3,9 @@ module GeocoderHelper
     html_options = {}
     #html_options[:title] = strip_tags(result[:description]) if result[:description]
     if result[:min_lon] and result[:min_lat] and result[:max_lon] and result[:max_lat]
-      html_options[:href] = "?minlon=#{result[:min_lon]}&minlat=#{result[:min_lat]}&maxlon=#{result[:max_lon]}&maxlat=#{result[:max_lat]}"
+      html_options[:href] = raw("?minlon=#{result[:min_lon]}&minlat=#{result[:min_lat]}&maxlon=#{result[:max_lon]}&maxlat=#{result[:max_lat]}")
     else
-      html_options[:href] = "?mlat=#{result[:lat]}&mlon=#{result[:lon]}&zoom=#{result[:zoom]}"
+      html_options[:href] = raw("?mlat=#{result[:lat]}&mlon=#{result[:lon]}&zoom=#{result[:zoom]}")
     end
 
     html = ""
@@ -19,6 +19,7 @@ module GeocoderHelper
     end
 
     html << result[:suffix] if result[:suffix]
-    return html
+
+    return raw(html)
   end
 end

diff --git a/app/views/changeset/list.html.erb b/app/views/changeset/list.html.erb
index 22a798ffe25f4b89db1efa532bb9ea6bff2aa074..c7cf63353032e5daba5c6da638a5654ed65c3ddf 100644 (file)
--- a/app/views/changeset/list.html.erb
+++ b/app/views/changeset/list.html.erb
@@ -1,5 +1,5 @@
 <h1><%= @heading %></h1>
-<p><%= @description %></p>
+<p><%= raw(@description) %></p>
 
 <%= render :partial => 'changeset_paging_nav' %>
 

diff --git a/app/views/diary_entry/_diary_comment.html.erb b/app/views/diary_entry/_diary_comment.html.erb
index ef5c601e8f883ab543468c4b89a7066953a18855..da10c88ac9d939cd9c8107e6cb843d61e663f0ac 100644 (file)
--- a/app/views/diary_entry/_diary_comment.html.erb
+++ b/app/views/diary_entry/_diary_comment.html.erb
@@ -1,5 +1,5 @@
 <%= user_thumbnail diary_comment.user %>
-<h4 id="comment<%= diary_comment.id %>"><%= t('diary_entry.diary_comment.comment_from', :link_user => (link_to h(diary_comment.user.display_name), :controller => 'user', :action => 'view', :display_name => diary_comment.user.display_name), :comment_created_at => l(diary_comment.created_at, :format => :friendly)) %></h4>
+<h4 id="comment<%= diary_comment.id %>"><%= raw(t('diary_entry.diary_comment.comment_from', :link_user => (link_to h(diary_comment.user.display_name), :controller => 'user', :action => 'view', :display_name => diary_comment.user.display_name), :comment_created_at => l(diary_comment.created_at, :format => :friendly))) %></h4>
 <%= htmlize(diary_comment.body) %>
 <% if_administrator(:span) do %> 
   <%= link_to t('diary_entry.diary_comment.hide_link'), {:action => 'hidecomment', :display_name => diary_comment.diary_entry.user.display_name, :id => diary_comment.diary_entry.id, :comment => diary_comment.id}, {:confirm => t('diary_entry.diary_comment.confirm')} %>

diff --git a/app/views/diary_entry/_diary_entry.html.erb b/app/views/diary_entry/_diary_entry.html.erb
index d6e21869fbb06c7d1b7dc0fd8c5caa69d09cedc0..02100c74dbf8d4c596709c68c7fba0a30ec5bd7a 100644 (file)
--- a/app/views/diary_entry/_diary_entry.html.erb
+++ b/app/views/diary_entry/_diary_entry.html.erb
@@ -1,7 +1,7 @@
 <b><%= link_to h(diary_entry.title), :action => 'view', :display_name => diary_entry.user.display_name, :id => diary_entry.id %></b><br />
 
 <div xml:lang="<%= diary_entry.language_code %>" lang="<%= diary_entry.language_code %>">
-  <%= htmlize(diary_entry.body) %>
+  <%= raw(htmlize(diary_entry.body)) %>
 </div>
 
 <% if diary_entry.latitude and diary_entry.longitude %>
@@ -9,7 +9,7 @@
   <br />
 <% end %>
 
-<%= t 'diary_entry.diary_entry.posted_by', :link_user => (link_to h(diary_entry.user.display_name), :controller => 'user', :action => 'view', :display_name => diary_entry.user.display_name), :created => l(diary_entry.created_at, :format => :friendly), :language_link => (link_to h(diary_entry.language.name), :controller => 'diary_entry', :action => 'list', :language => diary_entry.language_code)  %> 
+<%= raw(t 'diary_entry.diary_entry.posted_by', :link_user => (link_to h(diary_entry.user.display_name), :controller => 'user', :action => 'view', :display_name => diary_entry.user.display_name), :created => l(diary_entry.created_at, :format => :friendly), :language_link => (link_to h(diary_entry.language.name), :controller => 'diary_entry', :action => 'list', :language => diary_entry.language_code)) %> 
 
 <% if params[:action] == 'list' %>
   <br />

diff --git a/app/views/geocoder/_description.html.erb b/app/views/geocoder/_description.html.erb
index b6a6d82fbcbebb4a698d5ed88cb68de3e4bc76cc..88b3bcc5f133598f187ec881cc7498710d76712f 100644 (file)
--- a/app/views/geocoder/_description.html.erb
+++ b/app/views/geocoder/_description.html.erb
@@ -1,8 +1,8 @@
 <% @sources.each do |source| %>
   <% if source[:types] %>
-    <p class="search_results_heading"><%= t("geocoder.description.title.#{source[:name]}", :types => t("geocoder.description.types.#{source[:types]}")) %></p>
+    <p class="search_results_heading"><%= raw(t("geocoder.description.title.#{source[:name]}", :types => t("geocoder.description.types.#{source[:types]}"))) %></p>
   <% else %>
-    <p class="search_results_heading"><%= t("geocoder.description.title.#{source[:name]}") %></p>
+    <p class="search_results_heading"><%= raw(t("geocoder.description.title.#{source[:name]}")) %></p>
   <% end %>
   <div class='search_results_entry' id='<%= "description_#{source[:name]}_#{source[:types]}" %>'>
     <%= image_tag "searching.gif", :class => "search_searching" %>

diff --git a/app/views/geocoder/_search.html.erb b/app/views/geocoder/_search.html.erb
index 7aac94f8ec181952404fce2af52badb3ea49e6ea..8a58c0349b475489b354e4a31076d323dccd2d42 100644 (file)
--- a/app/views/geocoder/_search.html.erb
+++ b/app/views/geocoder/_search.html.erb
@@ -1,5 +1,5 @@
 <% @sources.each do |source| %>
-  <p class="search_results_heading"><%= t "geocoder.search.title.#{source}" %></p>
+  <p class="search_results_heading"><%= raw(t "geocoder.search.title.#{source}") %></p>
   <div class='search_results_entry' id='<%= "search_#{source}" %>'>
     <%= image_tag "searching.gif", :class => "search_searching" %>
   </div>

diff --git a/app/views/layouts/_flash.html.erb b/app/views/layouts/_flash.html.erb
index da559d55c924488dfaee1a789a001d5073110ba8..0380a50945454794a7065785c8ad07d0b7822c59 100644 (file)
--- a/app/views/layouts/_flash.html.erb
+++ b/app/views/layouts/_flash.html.erb
@@ -1,11 +1,11 @@
 <% if flash[:error] %>
-  <div id="error"><%= flash[:error] %></div>
+  <div id="error"><%= raw flash[:error] %></div>
 <% end %>
 
 <% if flash[:warning] %>
-  <div id="warning"><%= flash[:warning] %></div>
+  <div id="warning"><%= raw flash[:warning] %></div>
 <% end %>
 
 <% if flash[:notice] %>
-  <div id="notice"><%= flash[:notice] %></div>
+  <div id="notice"><%= raw flash[:notice] %></div>
 <% end %>

diff --git a/app/views/layouts/site.html.erb b/app/views/layouts/site.html.erb
index 3a8e1f1c0a03505ae5c513e7d4aba3cf23235d37..db3b4c6e31ef7e3f97a67f6abb3e0d41df151548 100644 (file)
--- a/app/views/layouts/site.html.erb
+++ b/app/views/layouts/site.html.erb
@@ -14,7 +14,7 @@
 
     <span id="greeting">
       <% if @user and @user.id %>
-        <span id="full-greeting"><%= t 'layouts.welcome_user', :user_link => (link_to h(@user.display_name), {:controller => 'user', :action => 'view', :display_name => @user.display_name}, :title => t('layouts.welcome_user_link_tooltip')) %></span> 
+        <span id="full-greeting"><%= raw(t 'layouts.welcome_user', :user_link => (link_to h(@user.display_name), {:controller => 'user', :action => 'view', :display_name => @user.display_name}, :title => t('layouts.welcome_user_link_tooltip'))) %></span> 
         <span id="small-greeting"><%= link_to t('layouts.welcome_user_link_tooltip'), {:controller => 'user', :action => 'view', :display_name => @user.display_name} %></span> | 
         <%= yield :greeting %>
         <%= render :partial => "layouts/inbox" %> |
@@ -83,11 +83,11 @@
           <%= t 'layouts.intro_2' %>
         </p>
         <p>
-        <%= t 'layouts.intro_3', 
-              :ucl => link_to(t('layouts.intro_3_ucl'), "http://www.vr.ucl.ac.uk"),
-              :ic => link_to(t('layouts.intro_3_ic'), "http://www.imperial.ac.uk/"),
-              :bytemark => link_to(t('layouts.intro_3_bytemark'), "http://www.bytemark.co.uk"),
-              :partners => link_to(t('layouts.intro_3_partners'), t('layouts.intro_3_partners_url')) %>
+        <%= raw(t 'layouts.intro_3', 
+                  :ucl => link_to(t('layouts.intro_3_ucl'), "http://www.vr.ucl.ac.uk"),
+                  :ic => link_to(t('layouts.intro_3_ic'), "http://www.imperial.ac.uk/"),
+                  :bytemark => link_to(t('layouts.intro_3_bytemark'), "http://www.bytemark.co.uk"),
+                  :partners => link_to(t('layouts.intro_3_partners'), t('layouts.intro_3_partners_url'))) %>
         </p>
       </div>
       <% end %>

diff --git a/app/views/message/inbox.html.erb b/app/views/message/inbox.html.erb
index 897fb24adc14c9bbed07951c48d3a22024006c83..bcd2da33a14abcf7bb560c6996ede6244de10fff 100644 (file)
--- a/app/views/message/inbox.html.erb
+++ b/app/views/message/inbox.html.erb
@@ -17,5 +17,5 @@
     </table>
   </div>
 <% else %>
-  <div id="messages"><%= t'message.inbox.no_messages_yet', :people_mapping_nearby_link => link_to(t('message.inbox.people_mapping_nearby'), :controller => 'user', :action => 'view', :display_name => @user.display_name) %></div>
+  <div id="messages"><%= raw(t'message.inbox.no_messages_yet', :people_mapping_nearby_link => link_to(t('message.inbox.people_mapping_nearby'), :controller => 'user', :action => 'view', :display_name => @user.display_name)) %></div>
 <% end %>

diff --git a/app/views/message/new.html.erb b/app/views/message/new.html.erb
index f2005bb00c1d13aa5558e57881bed3f997c70758..113e566d82b74b4bcab5cbb423234ec852f9cddf 100644 (file)
--- a/app/views/message/new.html.erb
+++ b/app/views/message/new.html.erb
@@ -1,4 +1,4 @@
-<h2><%= t'message.new.send_message_to', :name => link_to(h(@to_user.display_name), {:controller => 'user', :action => 'view', :display_name => @to_user.display_name}) %></h2>
+<h2><%= raw(t'message.new.send_message_to', :name => link_to(h(@to_user.display_name), {:controller => 'user', :action => 'view', :display_name => @to_user.display_name})) %></h2>
 
 <%= error_messages_for 'message' %>
 

diff --git a/app/views/message/outbox.html.erb b/app/views/message/outbox.html.erb
index afd1d2fc530b96d1624d3a1d855fff5f4a289e5b..9662fdbce397b13076f31dadc325a10aed8fa567 100644 (file)
--- a/app/views/message/outbox.html.erb
+++ b/app/views/message/outbox.html.erb
@@ -1,4 +1,4 @@
-<h2><%= t'message.outbox.my_inbox', :inbox_link => link_to(t('message.outbox.inbox'), url_for(:controller => "user", :action => "inbox", :id => @user.display_name)) %>/<%= t'message.outbox.outbox' %></h2>
+<h2><%= raw(t'message.outbox.my_inbox', :inbox_link => link_to(t('message.outbox.inbox'), url_for(:controller => "user", :action => "inbox", :id => @user.display_name))) %>/<%= t'message.outbox.outbox' %></h2>
 
 <p><%= t'message.outbox.you_have_sent_messages', :count => @user.sent_messages.size %>
 
@@ -15,5 +15,5 @@
     </table>
   </div>
 <% else %>
-  <div id="messages"><%= t'message.outbox.no_sent_messages', :people_mapping_nearby_link => link_to(t('message.outbox.people_mapping_nearby'), :controller => 'user', :action => 'view', :display_name => @user.display_name) %></div>
+  <div id="messages"><%= raw(t'message.outbox.no_sent_messages', :people_mapping_nearby_link => link_to(t('message.outbox.people_mapping_nearby'), :controller => 'user', :action => 'view', :display_name => @user.display_name)) %></div>
 <% end %>

diff --git a/app/views/notifier/signup_confirm.text.html.erb b/app/views/notifier/signup_confirm.text.html.erb
index c0883382e7a76fd13b5ad89769c493b6a114759e..5b7566fba9730d3482dcccb6ab5c9b087228512d 100644 (file)
--- a/app/views/notifier/signup_confirm.text.html.erb
+++ b/app/views/notifier/signup_confirm.text.html.erb
@@ -5,16 +5,17 @@
 
 <p><%= t'notifier.signup_confirm_html.click_the_link' %></p>
 
-<p><a href="<%= @url %>"><%= @url %></a></p>
+<p><%= raw(link_to @url, @url) %></p>
 
-<p><%= t'notifier.signup_confirm_html.introductory_video', :introductory_video_link => ('<a href="http://showmedo.com/videos/video?name=1800000&fromSeriesID=180">' + t('notifier.signup_confirm_html.video_to_openstreetmap') + '</a>') %> <%= t'notifier.signup_confirm_html.more_videos', :more_videos_link => ('<a href="http://showmedo.com/videos/series?name=mS2P1ZqS6">' + t('notifier.signup_confirm_html.more_videos_here') + '</a>') %>
+<p><%= raw(t'notifier.signup_confirm_html.introductory_video', :introductory_video_link => link_to(t('notifier.signup_confirm_html.video_to_openstreetmap'), "http://showmedo.com/videos/video?name=1800000&fromSeriesID=180")) %>
+   <%= raw(t'notifier.signup_confirm_html.more_videos', :more_videos_link => link_to(t('notifier.signup_confirm_html.more_videos_here'), "http://showmedo.com/videos/series?name=mS2P1ZqS6")) %></p>
 
-<p><%= t'notifier.signup_confirm_html.get_reading' %></p>
+<p><%= raw(t'notifier.signup_confirm_html.get_reading') %></p>
 
-<p><%= t'notifier.signup_confirm_html.ask_questions' %></p>
+<p><%= raw(t'notifier.signup_confirm_html.ask_questions') %></p>
 
-<p><%= t'notifier.signup_confirm_html.wiki_signup' %></p>
+<p><%= raw(t'notifier.signup_confirm_html.wiki_signup') %></p>
 
-<p><%= t'notifier.signup_confirm_html.user_wiki_page' %></p> 
+<p><%= raw(t'notifier.signup_confirm_html.user_wiki_page') %></p> 
 
-<p><%= t'notifier.signup_confirm_html.current_user' %></p>
+<p><%= raw(t'notifier.signup_confirm_html.current_user') %></p>

diff --git a/app/views/oauth_clients/index.html.erb b/app/views/oauth_clients/index.html.erb
index 91c71f90b0a0266a1b918b0651bb6c2b9f0be092..d698728f5e7c12c3ff0f352093f545cb30dfc752 100644 (file)
--- a/app/views/oauth_clients/index.html.erb
+++ b/app/views/oauth_clients/index.html.erb
@@ -21,7 +21,7 @@
 <% end %>
 <h3><%= t'oauth_clients.index.my_apps' %></h3>
 <% if @client_applications.empty? %>
-<p><%= t('oauth_clients.index.no_apps', :oauth => "<a href=\"http://oauth.net\">OAuth</a>") %></p>
+<p><%= raw(t('oauth_clients.index.no_apps', :oauth => "<a href=\"http://oauth.net\">OAuth</a>")) %></p>
 <% else %>
 <p><%= t'oauth_clients.index.registered_apps' %></p>
 <% @client_applications.each do |client|%>

diff --git a/app/views/site/_search.html.erb b/app/views/site/_search.html.erb
index b1e5f448732ccd9b1bd067cd9ef49e3855c2dd4d..2c914d14ced6a1138492f3e52909b0106817c2a1 100644 (file)
--- a/app/views/site/_search.html.erb
+++ b/app/views/site/_search.html.erb
@@ -82,7 +82,7 @@
     </div>
     </div>
     <p class="search_help">
-      <%= t 'site.search.search_help' %>
+      <%= raw(t 'site.search.search_help') %>
     </p>
   </div>
 <% end %>

diff --git a/app/views/site/copyright.html.erb b/app/views/site/copyright.html.erb
index b5f0db418e35240efce441784eda005f1a18eac9..92c84c74525cb57b5b70ed3c134c33995b3f99d3 100644 (file)
--- a/app/views/site/copyright.html.erb
+++ b/app/views/site/copyright.html.erb
@@ -41,5 +41,5 @@
     <hr />
   <% end %>
 
-  <%= t('license_page.legal_babble') %>
+  <%= raw(t('license_page.legal_babble')) %>
 <% end %>

diff --git a/app/views/trace/_trace.html.erb b/app/views/trace/_trace.html.erb
index 31e4cf0b1cc708fd68f64729507b9c32c02b9af0..32717d8242bebff9b6c6929e7b43de336b6b5a66 100644 (file)
--- a/app/views/trace/_trace.html.erb
+++ b/app/views/trace/_trace.html.erb
@@ -25,7 +25,7 @@
     <%= t'trace.trace.by' %> <%=link_to h(trace.user.display_name), {:controller => 'user', :action => 'view', :display_name => trace.user.display_name} %>
     <% if !trace.tags.empty? %>
       <%= t'trace.trace.in' %> 
-      <%= trace.tags.collect { |tag| link_to_tag tag.tag }.join(", ") %>
+      <%= raw(trace.tags.collect { |tag| link_to_tag tag.tag }.join(", ")) %>
     <% end %>
   </td>
 </tr>

diff --git a/app/views/trace/view.html.erb b/app/views/trace/view.html.erb
index 0d9b6213f81a1ebb3dc4b69de7645b688d0869d8..1f272b271df0a41b15ae1bb2577c4402add5669a 100644 (file)
--- a/app/views/trace/view.html.erb
+++ b/app/views/trace/view.html.erb
@@ -38,7 +38,7 @@
     <td><%= t'trace.view.tags' %></td>
     <td>
     <% unless @trace.tags.empty? %>
-      <%= @trace.tags.collect { |tag| link_to tag.tag, { :controller => 'trace', :action => 'list', :tag => tag.tag, :id => nil } }.join(", ") %>
+      <%= raw(@trace.tags.collect { |tag| link_to tag.tag, { :controller => 'trace', :action => 'list', :tag => tag.tag, :id => nil } }.join(", ")) %>
     <% else %>
       <i><%= t'trace.view.none' %></i>
     <% end %>

diff --git a/app/views/user/new.html.erb b/app/views/user/new.html.erb
index a988afd80a946dff19d64833d01d9070cfa3c5c2..9fcbfdcba76d8dc3dd5f0104fbc29c2c2d67fe11 100644 (file)
--- a/app/views/user/new.html.erb
+++ b/app/views/user/new.html.erb
@@ -26,7 +26,7 @@
     </tr>
     <tr>
       <td></td>
-      <td><span class="minorNote"><%= t 'user.new.not displayed publicly' %></span></td>
+      <td><span class="minorNote"><%= raw(t 'user.new.not displayed publicly') %></span></td>
     </tr>
 
     <tr><td colspan="2">&nbsp;<!--vertical spacer--></td></tr>

diff --git a/app/views/user/view.html.erb b/app/views/user/view.html.erb
index 834e8571b6cc358da50b4f7a58869db5181130bb..4cb2b9e5ae5466ba035ded6291b434b5d49f8203 100644 (file)
--- a/app/views/user/view.html.erb
+++ b/app/views/user/view.html.erb
@@ -92,7 +92,7 @@
 <% if @user and @this_user.id == @user.id %>
   <div id="map" class="user_map">
     <% if @this_user.home_lat.nil? or @this_user.home_lon.nil? %>
-      <p id="no_home_location"><%= t 'user.view.if set location', :settings_link => (link_to t('user.view.settings_link_text'), :controller => 'user', :action => 'account', :display_name => @user.display_name) %></p>
+      <p id="no_home_location"><%= raw(t 'user.view.if set location', :settings_link => (link_to t('user.view.settings_link_text'), :controller => 'user', :action => 'account', :display_name => @user.display_name)) %></p>
     <% else %>
       <%= render :partial => 'map', :locals => { :setting_location => false, :show_other_users => true } %>
     <% end %>

diff --git a/app/views/user_blocks/blocks_by.html.erb b/app/views/user_blocks/blocks_by.html.erb
index c9158536b9708836d2017407218f8ad45fd45f2a..dc523cee9fb9304b2f0ea874905b4769bd00b477 100644 (file)
--- a/app/views/user_blocks/blocks_by.html.erb
+++ b/app/views/user_blocks/blocks_by.html.erb
@@ -1,5 +1,5 @@
 <% @title = t('user_block.blocks_by.title', :name => h(@this_user.display_name)) %>
-<h1><%= t('user_block.blocks_by.heading', :name => link_to(h(@this_user.display_name), {:controller => 'user', :action => 'view', :display_name => @this_user.display_name})) %></h1>
+<h1><%= raw(t('user_block.blocks_by.heading', :name => link_to(h(@this_user.display_name), {:controller => 'user', :action => 'view', :display_name => @this_user.display_name}))) %></h1>
 
 <% unless @user_blocks.empty? %>
 <%= render :partial => 'blocks', :locals => { :show_revoke_link => (@user and @user.moderator?), :show_user_name => true, :show_creator_name => false } %>

diff --git a/app/views/user_blocks/blocks_on.html.erb b/app/views/user_blocks/blocks_on.html.erb
index 2074af433defaf027844eab07c92cf80b9dacd31..86ae110dfec6fd8aae85bdb19c4a384d2be1dacb 100644 (file)
--- a/app/views/user_blocks/blocks_on.html.erb
+++ b/app/views/user_blocks/blocks_on.html.erb
@@ -1,5 +1,5 @@
 <% @title = t('user_block.blocks_on.title', :name => h(@this_user.display_name)) %>
-<h1><%= t('user_block.blocks_on.heading', :name => link_to(h(@this_user.display_name), {:controller => 'user', :action => 'view', :display_name => @this_user.display_name})) %></h1>
+<h1><%= raw(t('user_block.blocks_on.heading', :name => link_to(h(@this_user.display_name), {:controller => 'user', :action => 'view', :display_name => @this_user.display_name}))) %></h1>
 
 <% unless @user_blocks.empty? %>
 <%= render :partial => 'blocks', :locals => { :show_revoke_link => (@user and @user.moderator?), :show_user_name => false, :show_creator_name => true } %>