From fab50c130baf482288d510427a6632e6489a55d6 Mon Sep 17 00:00:00 2001
From: Justin Coyne <justin@curationexperts.com>
Date: Fri, 2 Jan 2015 17:07:01 -0600
Subject: Unsafe default translations should not be marked html_safe

Previously default translation keys that didn't end in `_html`, but came
after a missing key that ended in `_html` were being returned as
html_safe. Now they are not. Fixes #18257
---
 actionview/CHANGELOG.md                            |  5 ++++
 .../lib/action_view/helpers/translation_helper.rb  | 28 +++++++---------------
 .../test/template/translation_helper_test.rb       |  6 +++++
 3 files changed, 20 insertions(+), 19 deletions(-)

(limited to 'actionview')

diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md
index 321501a3bf..6357f8ac57 100644
--- a/actionview/CHANGELOG.md
+++ b/actionview/CHANGELOG.md
@@ -1,3 +1,8 @@
+*   Default translations that have a lower precidence than an html safe default,
+    but are not themselves safe, should not be marked as html_safe.
+
+    *Justin Coyne*
+
 *   Make possible to use blocks with short version of `render "partial"` helper.
 
     *Nikolay Shebanov*
diff --git a/actionview/lib/action_view/helpers/translation_helper.rb b/actionview/lib/action_view/helpers/translation_helper.rb
index c2fda42396..8324f12a88 100644
--- a/actionview/lib/action_view/helpers/translation_helper.rb
+++ b/actionview/lib/action_view/helpers/translation_helper.rb
@@ -37,7 +37,8 @@ module ActionView
       # you know what kind of output to expect when you call translate in a template.
       def translate(key, options = {})
         options = options.dup
-        options[:default] = wrap_translate_defaults(options[:default]) if options[:default]
+        remaining_defaults = Array(options.delete(:default))
+        options[:default] = remaining_defaults.shift if remaining_defaults.first.kind_of? String
 
         # If the user has specified rescue_format then pass it all through, otherwise use
         # raise and do the work ourselves
@@ -62,10 +63,14 @@ module ActionView
           I18n.translate(scope_key_by_partial(key), options)
         end
       rescue I18n::MissingTranslationData => e
-        raise e if raise_error
+        if remaining_defaults.present?
+          translate remaining_defaults.shift, options.merge(default: remaining_defaults)
+        else
+          raise e if raise_error
 
-        keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope])
-        content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}")
+          keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope])
+          content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}")
+        end
       end
       alias :t :translate
 
@@ -94,21 +99,6 @@ module ActionView
         def html_safe_translation_key?(key)
           key.to_s =~ /(\b|_|\.)html$/
         end
-
-        def wrap_translate_defaults(defaults)
-          new_defaults = []
-          defaults     = Array(defaults)
-          while key = defaults.shift
-            if key.is_a?(Symbol)
-              new_defaults << lambda { |_, options| translate key, options.merge(:default => defaults) }
-              break
-            else
-              new_defaults << key
-            end
-          end
-
-          new_defaults
-        end
     end
   end
 end
diff --git a/actionview/test/template/translation_helper_test.rb b/actionview/test/template/translation_helper_test.rb
index 362f05ea70..dea861c0e5 100644
--- a/actionview/test/template/translation_helper_test.rb
+++ b/actionview/test/template/translation_helper_test.rb
@@ -145,6 +145,12 @@ class TranslationHelperTest < ActiveSupport::TestCase
     assert_equal true, translation.html_safe?
   end
 
+  def test_translate_with_last_default_not_named_html
+    translation = translate(:'translations.missing', :default => [:'translations.missing_html', :'translations.foo'])
+    assert_equal 'Foo', translation
+    assert_equal false, translation.html_safe?
+  end
+
   def test_translate_with_string_default
     translation = translate(:'translations.missing', default: 'A Generic String')
     assert_equal 'A Generic String', translation
-- 
cgit v1.2.3