Merge pull request #37 from hitobito/render_educations_columns_correctly

Make educations columns html safe after sanitizing qualification kind label
hitobito · Oct 30, 2023 · eb643df · eb643df
2 parents b52e718 + 7290309
commit eb643df
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/app/helpers/group_educations_helper.rb b/app/helpers/group_educations_helper.rb
@@ -14,10 +14,11 @@ def joined_qualification_kind_labels(person)
       reverse.
       uniq(&:qualification_kind).
       collect do |q|
-        label = "#{q.qualification_kind.label} #{format_attr(q, :finish_at)}".strip
+        label = "#{h(q.qualification_kind.label)} #{format_attr(q, :finish_at)}".strip
         content_tag(:span, label, class: qualification_label_class(q))
       end.
-      join('<br/>')
+      join('<br/>').
+      html_safe
   end
 
   def joined_event_participations(person)
@@ -30,7 +31,8 @@ def joined_event_participations(person)
       collect do |p|
         format_open_participation_event(p)
       end.
-      join(', ')
+      join(', ').
+      html_safe
   end
 
   def format_open_participation_event(participation)

diff --git a/spec/helpers/group_educations_helper_spec.rb b/spec/helpers/group_educations_helper_spec.rb
@@ -14,6 +14,7 @@
   include LayoutHelper
   include UtilityHelper
   include QualificationsHelper
+  include ERB::Util
 
   subject { joined_qualification_kind_labels(user) }