aboutsummaryrefslogtreecommitdiffstats
path: root/guides/source/action_view_overview.md
diff options
context:
space:
mode:
Diffstat (limited to 'guides/source/action_view_overview.md')
-rw-r--r--guides/source/action_view_overview.md107
1 files changed, 52 insertions, 55 deletions
diff --git a/guides/source/action_view_overview.md b/guides/source/action_view_overview.md
index 3542844f33..5cda104138 100644
--- a/guides/source/action_view_overview.md
+++ b/guides/source/action_view_overview.md
@@ -152,7 +152,7 @@ By default, Rails will compile each template to a method in order to render it.
### Partials
-Partial templates – usually just called "partials" – are another device for breaking the rendering process into more manageable chunks. With partials, you can extract pieces of code from your templates to separate files and also reuse them throughout your templates.
+Partial templates - usually just called "partials" - are another device for breaking the rendering process into more manageable chunks. With partials, you can extract pieces of code from your templates to separate files and also reuse them throughout your templates.
#### Naming Partials
@@ -1520,94 +1520,91 @@ number_with_precision(111.2345) # => 111.235
number_with_precision(111.2345, 2) # => 111.23
```
-Localized Views
----------------
+### SanitizeHelper
-Action View has the ability render different templates depending on the current locale.
+The SanitizeHelper module provides a set of methods for scrubbing text of undesired HTML elements.
-For example, suppose you have a Posts controller with a show action. By default, calling this action will render `app/views/posts/show.html.erb`. But if you set `I18n.locale = :de`, then `app/views/posts/show.de.html.erb` will be rendered instead. If the localized template isn't present, the undecorated version will be used. This means you're not required to provide localized views for all cases, but they will be preferred and used if available.
+#### sanitize
-You can use the same technique to localize the rescue files in your public directory. For example, setting `I18n.locale = :de` and creating `public/500.de.html` and `public/404.de.html` would allow you to have localized rescue pages.
+This sanitize helper will html encode all tags and strip all attributes that aren't specifically allowed.
-Since Rails doesn't restrict the symbols that you use to set I18n.locale, you can leverage this system to display different content depending on anything you like. For example, suppose you have some "expert" users that should see different pages from "normal" users. You could add the following to `app/controllers/application.rb`:
+```ruby
+sanitize @article.body
+```
+
+If either the :attributes or :tags options are passed, only the mentioned tags and attributes are allowed and nothing else.
```ruby
-before_action :set_expert_locale
+sanitize @article.body, tags: %w(table tr td), attributes: %w(id class style)
+```
-def set_expert_locale
- I18n.locale = :expert if current_user.expert?
+To change defaults for multiple uses, for example adding table tags to the default:
+
+```ruby
+class Application < Rails::Application
+ config.action_view.sanitized_allowed_tags = 'table', 'tr', 'td'
end
```
-Then you could create special views like `app/views/posts/show.expert.html.erb` that would only be displayed to expert users.
+#### sanitize_css(style)
-You can read more about the Rails Internationalization (I18n) API [here](i18n.html).
+Sanitizes a block of CSS code.
-Using Action View outside of Rails
-----------------------------------
+#### strip_links(html)
+Strips all link tags from text leaving just the link text.
-Action View is a Rails component, but it can also be used without Rails. We can demonstrate this by creating a small [Rack](http://rack.rubyforge.org/) application that includes Action View functionality. This may be useful, for example, if you'd like access to Action View's helpers in a Rack application.
+```ruby
+strip_links("<a href="http://rubyonrails.org">Ruby on Rails</a>")
+# => Ruby on Rails
+```
-Let's start by ensuring that you have the Action Pack and Rack gems installed:
+```ruby
+strip_links("emails to <a href="mailto:me@email.com">me@email.com</a>.")
+# => emails to me@email.com.
+```
-```bash
-$ gem install actionpack
-$ gem install rack
+```ruby
+strip_links('Blog: <a href="http://myblog.com/">Visit</a>.')
+# => Blog: Visit.
```
-Now we'll create a simple "Hello World" application that uses the `titleize` method provided by Active Support.
+#### strip_tags(html)
-**hello_world.rb:**
+Strips all HTML tags from the html, including comments.
+This uses the html-scanner tokenizer and so its HTML parsing ability is limited by that of html-scanner.
```ruby
-require 'active_support/core_ext/string/inflections'
-require 'rack'
-
-def hello_world(env)
- [200, {"Content-Type" => "text/html"}, "hello world".titleize]
-end
-
-Rack::Handler::Mongrel.run method(:hello_world), Port: 4567
+strip_tags("Strip <i>these</i> tags!")
+# => Strip these tags!
```
-We can see this all come together by starting up the application and then visiting `http://localhost:4567/`
-
-```bash
-$ ruby hello_world.rb
+```ruby
+strip_tags("<b>Bold</b> no more! <a href='more.html'>See more</a>")
+# => Bold no more! See more
```
-TODO needs a screenshot? I have one - not sure where to put it.
+NB: The output may still contain unescaped '<', '>', '&' characters and confuse browsers.
-Notice how 'hello world' has been converted into 'Hello World' by the `titleize` helper method.
-Action View can also be used with [Sinatra](http://www.sinatrarb.com/) in the same way.
+Localized Views
+---------------
-Let's start by ensuring that you have the Action Pack and Sinatra gems installed:
+Action View has the ability render different templates depending on the current locale.
-```bash
-$ gem install actionpack
-$ gem install sinatra
-```
+For example, suppose you have a Posts controller with a show action. By default, calling this action will render `app/views/posts/show.html.erb`. But if you set `I18n.locale = :de`, then `app/views/posts/show.de.html.erb` will be rendered instead. If the localized template isn't present, the undecorated version will be used. This means you're not required to provide localized views for all cases, but they will be preferred and used if available.
-Now we'll create the same "Hello World" application in Sinatra.
+You can use the same technique to localize the rescue files in your public directory. For example, setting `I18n.locale = :de` and creating `public/500.de.html` and `public/404.de.html` would allow you to have localized rescue pages.
-**hello_world.rb:**
+Since Rails doesn't restrict the symbols that you use to set I18n.locale, you can leverage this system to display different content depending on anything you like. For example, suppose you have some "expert" users that should see different pages from "normal" users. You could add the following to `app/controllers/application.rb`:
```ruby
-require 'action_view'
-require 'sinatra'
+before_action :set_expert_locale
-get '/' do
- erb 'hello world'.titleize
+def set_expert_locale
+ I18n.locale = :expert if current_user.expert?
end
```
-Then, we can run the application:
-
-```bash
-$ ruby hello_world.rb
-```
-
-Once the application is running, you can see Sinatra and Action View working together by visiting `http://localhost:4567/`
+Then you could create special views like `app/views/posts/show.expert.html.erb` that would only be displayed to expert users.
-TODO needs a screenshot? I have one - not sure where to put it.
+You can read more about the Rails Internationalization (I18n) API [here](i18n.html).