diff options
| author | Joost Baaij <joost@spacebabies.nl> | 2012-11-16 09:11:43 +0100 |
|---|---|---|
| committer | Joost Baaij <joost@spacebabies.nl> | 2012-11-16 09:11:43 +0100 |
| commit | 5f189f41258b83d49012ec5a0678d827327e7543 (patch) | |
| tree | a4dc887d3bd1a3bb3cb58866b2b377661eacb6fe /tasks | |
| parent | 44f12bbba08071178ec256c03eecadacdf35dccf (diff) | |
| download | rails-5f189f41258b83d49012ec5a0678d827327e7543.tar.gz rails-5f189f41258b83d49012ec5a0678d827327e7543.tar.bz2 rails-5f189f41258b83d49012ec5a0678d827327e7543.zip | |
Introduce `ActionView::Template::Handlers::ERB.escape_whitelist`.
This is a list of mime types where template text is not html escaped
by default. It prevents `Jack & Joe` from rendering as
`Jack & Joe` for the whitelisted mime types. The default whitelist
contains text/plain.
This follows a whitelist approach where plain text templates are
not escaped, and all the others (json, xml) are. The mime type is
assumed to be set by the abstract controller.
Diffstat (limited to 'tasks')
0 files changed, 0 insertions, 0 deletions