CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-4
newUserNameHere
newUserNameHere

Reputation: 18001

Html Safe Flash Hash in Rails 4?

I would like to put a link in my flash hash.

I have setting my flash hash like this:

flash.now[:notice] = "<a href='http://google.com'>foo</a>".html_safe

And in the view I have:

= notice.html_safe

However, characters such as "<" are still escaped and the link does not work.

I can see how this may make it easier for hackers to do XSS injections. Is that the reason this is disabled? Or is there something else I must do to make this work?

Upvotes: 1

Views: 284

Answers (1)

Hiroaki Machida
Hiroaki Machida

Reputation: 1090

To unescape, you need

= raw notice

UPDATE

In addition to the above, please try

flash.now[:notice] = "<a href='http://google.com'>foo</a>"

Upvotes: 1

Related Questions