0
@@ -297,11 +297,16 @@ class BasketsController < ApplicationController
0
   def update_appearance
0
     @basket = Basket.find(params[:id])
0
     do_not_sanitize = (params[:settings][:do_not_sanitize_footer_content] == 'true')
0
+    original_html = params[:settings][:additional_footer_content]
0
+    sanitized_html = original_html
0
     unless do_not_sanitize && @site_admin
0
-      params[:settings][:additional_footer_content] = sanitize(params[:settings][:additional_footer_content])
0
+      sanitized_html = sanitize(original_html)
0
+      params[:settings][:additional_footer_content] = sanitized_html
0
     end
0
     set_settings
0
     flash[:notice] = 'Basket appearance was updated.'
0
+    logger.debug("sanitized yes") if original_html != sanitized_html
0
+    flash[:notice] += ' Your submitted footer content was changed for security reasons.' if original_html != sanitized_html
0
     redirect_to :action => :appearance
0
   end
0
 
0
@@ -378,7 +383,7 @@ class BasketsController < ApplicationController
0
   end
0
 
0
   def current_basket_is_selected?
0
-    params[:id].blank? or @current_basket.id == params[:id]
0
+    params[:id].blank? || @current_basket.id == params[:id]
0
   end
0
 
0
   private