From eb46afa5939f11c176ee1baf53df7713a586f42c Mon Sep 17 00:00:00 2001 From: Xavier Noria Date: Thu, 17 Nov 2011 23:07:06 +0100 Subject: [PATCH] warn the user values are directly interpolated into _html translation strings --- .../lib/action_view/helpers/translation_helper.rb | 2 ++ railties/guides/source/i18n.textile | 12 ++++++++++++ 2 files changed, 14 insertions(+) diff --git a/actionpack/lib/action_view/helpers/translation_helper.rb b/actionpack/lib/action_view/helpers/translation_helper.rb index be64dc823edc1..0e6c3c572459b 100644 --- a/actionpack/lib/action_view/helpers/translation_helper.rb +++ b/actionpack/lib/action_view/helpers/translation_helper.rb @@ -43,6 +43,8 @@ module TranslationHelper # a safe HTML string that won't be escaped by other HTML helper methods. This # naming convention helps to identify translations that include HTML tags so that # you know what kind of output to expect when you call translate in a template. + # Note however that rule extends to interpolated values, so you are responsible + # for passing them already escaped in the call, if they need to be. def translate(key, options = {}) options.merge!(:rescue_format => :html) unless options.key?(:rescue_format) translation = I18n.translate(scope_key_by_partial(key), options) diff --git a/railties/guides/source/i18n.textile b/railties/guides/source/i18n.textile index 840f464eda72f..b729ff1a7fcc7 100644 --- a/railties/guides/source/i18n.textile +++ b/railties/guides/source/i18n.textile @@ -634,6 +634,18 @@ en: !images/i18n/demo_html_safe.png(i18n demo html safe)! +Please note that values are interpolated directly into the translation. +If they need to be escaped you need to pass them already escaped in the +t+ call. + + +# config/locales/en.yml +en: + welcome_html: Welcome %{name}! + +<%# Note the call to h() to avoid injection %> +<%= t('welcome_html', :name => h(user.name)) %> + + h3. How to Store your Custom Translations The Simple backend shipped with Active Support allows you to store translations in both plain Ruby and YAML format. [2]