CODEWITHSUNDEEP
ruby-on-railsrubybest-in-place
benl96
benl96

Reputation: 284

Ruby on Rails - best_in_place sanitize option doesn't work properly

I am using the following code in my view:

<div class="col-12 col-md-8">
    <% if current_user == @post.user || current_user.try(:admin?) %>
        <%=best_in_place @post, :body, :as => :textarea, inner_class: 'form-control', ok_button: 'update', ok_button_class: 'btn btn-outline-success btn-sm'%>
    <% else %>
        <p class="postbody"><%= sanitize @post.body %></p>
    <% end %>
    <div class="py-3">

Input text:

Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.

Expected: #code blocks doesn't accept html tags as it seems

Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.

Behavior

Lorem <b> ipsum </b> dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.

If I am logged out my post.body gets sanitized. However, if I am logged in the text accepts html tags. (doesn't get sanitized I guess) In the best_in_place documentation it says sanitize is set to true by default. I tried sanitize: true as well, still doesn't work.

Does anyone know why it behaves like this?

Best regards

Upvotes: 0

Views: 137

Answers (1)

Casper
Casper

Reputation: 34328

It seems there is an undocumented option:

raw: true

That will enable pure HTML to be rendered, without converting it to plain text before display. Someone else posted about the same problem on Github. See here:

https://github.com/bernat/best_in_place/issues/520

Upvotes: 1

Related Questions