876840e9ef
As far as I understand, the brakeman warning was a false-positive as `content_tag` properly escapes untrusted HTML. Furthermore, the interpolated string values are built from the “username” part of accounts, which is restricted to a small subset of ASCII that precludes any XML entity or HTML code. This proposed change should be functionally equivalent to the current code, however it is slightly more robust, it's more idiomatic, and Brakeman will stop complaining about it.
9 Zeilen
553 B
Text
9 Zeilen
553 B
Text
.log-entry
|
|
.log-entry__header
|
|
.log-entry__avatar
|
|
= image_tag action_log.account.avatar.url(:original), alt: '', width: 40, height: 40, class: 'avatar'
|
|
.log-entry__content
|
|
.log-entry__title
|
|
= t("admin.action_logs.actions.#{action_log.action}_#{action_log.target_type.underscore}_html", name: content_tag(:span, action_log.account.username, class: 'username'), target: content_tag(:span, log_target(action_log), class: 'target'))
|
|
.log-entry__timestamp
|
|
%time.formatted{ datetime: action_log.created_at.iso8601 }
|