i18n HTML escaping not working - ruby-on-rails-4

According to Ruby on Rails Guides (http://guides.rubyonrails.org/i18n.html#using-safe-html-translations) all I need to do to render my translations without calling html_safe on them is to have the key name end with _html. This is what I tried:
en:
breadcrumbs:
root_html: "<i class='material-icons'>home</i>"
Calling it like this:
I18n.t('breadcrumbs.root_html')
causes the output to be this very string defined inside my translations, but not the rendered HTML.
What am I doing wrong?
Using Ruby on Rails 4.2.1.
Thanks in advance!

Scrolling down a little further in the guide I found the problem:
Automatic conversion to HTML safe translate text is only available from the translate view helper method.
Since I tried to prepare the link inside my controller and pass it through a gem to the view, this didn't work.
To make this work you'll have to call html_safe on the string, like so:
I18n.t('breadcrumbs.root_html').html_safe
If you find another solution, hit me up!

Related

How to prevent XSS attacks with HTML/Javascript?

I want to know that how can I prevent script code and HTML attributes to stop from execution in editor of my website?
If someone add script tags with external link of code or call a function of jQuery in some attribute of HTML tag.
I am using markdown editor and django framework.
For example:
'>"></title></style></textarea></script><img src=x onerror=alert(document.domain)></script>
'>"></title></style></textarea></script><script/src=https://samengmg.xss.ht></script>
{{7*7}}{7*7}
use htmlEscape="true" for all input fields.
If you are displaying a value, try fn:escapeXml(value). You need to import jstl functions taglib

Escape jekyll liquid tags

This sounds very easy, however I couldn't find it anywhere in the docs. How can I write #site in a post code in jekyll, without it being processed by the engine?
It is being converted to https://github.com/site' class='user-mention'>https://github.com/site' class='user-mention'>#site
Try wrapping it in {%raw%} and {%endraw%}.

RenderComponentPresentation before any other markup Tridion Razor Page

I have a page template in Tridion 2011 with Razor code that prints information based on RenderComponentPresentation() as the first thing in the page. No other markup comes before it, because the component, not the page, contains the initial markup. Unless I put at least one character before the first RenderComponentPresentation in the published output, the template refuses to render any presentations.
So, for example, if this is all that is in the layout TBB this works (in my real code the tcms are real of course):
<
#RenderComponentPresentation("tcm:mytcm","tcm:myothertcm")
but this does not
#RenderComponentPresentation("tcm:mytcm","tcm:myothertcm")
The first prints the contents of the component preceded by the "<", whereas the second does nothing at all. I don't want to have ANY markup directly at the start of the page template, I want the first thing to be the component. Is it possible?
I've just done a quick test in Template Builder using the latest version of the Razor Mediator (1.2) and couldn't replicate your issue.
Maybe you could try:
<text></text>
#RenderComponentPresentation("tcm:mytcm","tcm"myothertcm")
It won't render any additional markup but may trick the mediator into doing what you want (though like I said, I can't replicate your problem so can't verify whether it does).
Normally with Razor you iterate over any and all Component Presentations on the page, and right now I'm working with
#foreach(var cp in ComponentPresentations){
#cp.RenderComponentPresentation()
}
This will render every component on the page, regardless of predefined schema's or templates. Your issue however suggest a problem elsewhere. What kind of output does your page template generate (do mind its the page template using a compound template which in turn includes the Razor TBB you describe here). Is it .aspx, HTML or other? And what is the Component templates' output? is it an HTML fragment, or anything else?
As far as you syntax goes, that should be just fine other than the template invocation:
#RenderComponentPresentation("tcm:x-xxx-xx", "tcm:xx-xxx-xx")
I have a feeling this code only works when used within HTML tags, though, but that's just a hunch.
Bit of a hack but have you tried:
<text>#RenderComponentPresentation("tcm:x-xxx-xx", "tcm:xx-xxx-xx")</text>
or
#Html.Raw(RenderComponentPresentation("tcm:x-xxx-xx", "tcm:xx-xxx-xx"))
Disclaimer: not really used Razor mediator. Just Razor.

Adding views/blocks programatically to tpl.php files in Drupal 7

I am trying to integrate the awkward showcase into my page--front.tpl.php. My first idea was to create a custom content type (slideshow image) and then a view that prints a list of those images. I was able to create the view and set it to be available as a block... but I have no idea how to include that block via my .tpl.php file. I don't want to just use the content region because it displays a bunch of "hello welcome to $sitename" messages that I couldn't figure out how to remove.
Also, what is the naming convention for views blocks? The machine name for the view I want to create a template of is called 'front_page_slideshow'
There's a way of adding views programatically,
the easiest way is using "views_embed_view()" http://api.drupal.org/api/views/views.module/function/views_embed_view/7
$view = views_embed_view('view_name', 'display', $args);
print $view;
For render a block (any kind of block) use this simple script I created:
https://gist.github.com/4001153
I would create a region['slideshow'] in your template. Then you assign the view that you've already created into it as a block. If you want to get really simple, till you figure how to drupal properly, you can just hack your page--front.tpl.php file and use include('yourslideshowfile.php'); to simply include your file there.

Textile renders to HTML, but Django is escaping it

I have a bunch of posts stored in text files formatted in yaml/textile (from Jekyll) that I am trying to import into my new Django project. The problem is that Django is escaping the actual html code, meaning my post is not getting formatted. How can I got about fixing this? should I change something in the jekyll-import command (a custom manage.py command), the postgresql server, or the views.py file?
Example:
The one thing I can’t do is write about myself. Hell, look at my about me page.
Well, I figured it out right after I posted it. I had tried this before but used the wrong syntax. To do this I just had to add '|safe' to the end of my body tag.
Like so:
{{ body|safe }}
Very nice.