diff options
Diffstat (limited to 'actiontext/app')
-rw-r--r-- | actiontext/app/helpers/action_text/content_helper.rb | 25 | ||||
-rw-r--r-- | actiontext/app/helpers/action_text/tag_helper.rb | 4 |
2 files changed, 20 insertions, 9 deletions
diff --git a/actiontext/app/helpers/action_text/content_helper.rb b/actiontext/app/helpers/action_text/content_helper.rb index b3335601f9..ed2887d865 100644 --- a/actiontext/app/helpers/action_text/content_helper.rb +++ b/actiontext/app/helpers/action_text/content_helper.rb @@ -1,21 +1,30 @@ # frozen_string_literal: true +require "rails-html-sanitizer" + module ActionText module ContentHelper - SANITIZER = Rails::Html::Sanitizer.white_list_sanitizer - ALLOWED_TAGS = SANITIZER.allowed_tags + [ ActionText::Attachment::TAG_NAME, "figure", "figcaption" ] - ALLOWED_ATTRIBUTES = SANITIZER.allowed_attributes + ActionText::Attachment::ATTRIBUTES + mattr_accessor(:sanitizer) { Rails::Html::Sanitizer.white_list_sanitizer.new } + mattr_accessor(:allowed_tags) { sanitizer.class.allowed_tags + [ ActionText::Attachment::TAG_NAME, "figure", "figcaption" ] } + mattr_accessor(:allowed_attributes) { sanitizer.class.allowed_attributes + ActionText::Attachment::ATTRIBUTES } + mattr_accessor(:scrubber) def render_action_text_content(content) - content = content.render_attachments do |attachment| + sanitize_action_text_content(render_action_text_attachments(content)) + end + + def sanitize_action_text_content(content) + sanitizer.sanitize(content.to_html, tags: allowed_tags, attributes: allowed_attributes, scrubber: scrubber).html_safe + end + + def render_action_text_attachments(content) + content.render_attachments do |attachment| unless attachment.in?(content.gallery_attachments) attachment.node.tap do |node| node.inner_html = render(attachment, in_gallery: false).chomp end end - end - - content = content.render_attachment_galleries do |attachment_gallery| + end.render_attachment_galleries do |attachment_gallery| render(layout: attachment_gallery, object: attachment_gallery) do attachment_gallery.attachments.map do |attachment| attachment.node.inner_html = render(attachment, in_gallery: true).chomp @@ -23,8 +32,6 @@ module ActionText end.join("").html_safe end.chomp end - - sanitize content.to_html, tags: ALLOWED_TAGS, attributes: ALLOWED_ATTRIBUTES end end end diff --git a/actiontext/app/helpers/action_text/tag_helper.rb b/actiontext/app/helpers/action_text/tag_helper.rb index 8434f2c611..1dc6202ae1 100644 --- a/actiontext/app/helpers/action_text/tag_helper.rb +++ b/actiontext/app/helpers/action_text/tag_helper.rb @@ -1,5 +1,7 @@ # frozen_string_literal: true +require "action_view/helpers/tags/placeholderable" + module ActionText module TagHelper cattr_accessor(:id, instance_accessor: false) { 0 } @@ -35,6 +37,8 @@ end module ActionView::Helpers class Tags::ActionText < Tags::Base + include Tags::Placeholderable + delegate :dom_id, to: ActionView::RecordIdentifier def render |