Do not parse HTML
Might allow an attacker (in this case someone creating a course in TISS) to do some nasty HTML injection. But eeeh, who cares? ¯\_(ツ)_/¯
This commit is contained in:
parent
b12d161b0e
commit
c9f93d6fd8
@ -4,11 +4,11 @@
|
||||
<%= button_to 'Add to favorites', action: :add_to_fav, id: @id, title: @project['titleDe'] %>
|
||||
<% if @project['abstractDe'] != nil %>
|
||||
<h4>Beschreibung</h4>
|
||||
<p><%= @project['abstractDe'] %></p>
|
||||
<p><%= raw @project['abstractDe'] %></p>
|
||||
<% else %>
|
||||
<% if @project['abstractEn'] != nil %>
|
||||
<h4>Beschreibung</h4>
|
||||
<p><%= @project['abstractEn'] %></p>
|
||||
<p><%= raw @project['abstractEn'] %></p>
|
||||
<% end %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user