maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
docbrown/app/models
History
Jeremy Friesen 3253ba2c7a
Patching ERB rendering of the data-info JSON (#16067) 
Prior to this commit, we were somewhat naively rendering Hash style data
attributes in our ERB templates.  By rendering each hash attribute
separately, we were rendering characters that could break the
javascript (e.g. double hack or backslash `"` or `\`).

By moving to this view_object rendering, we leverage Rails's `to_json`
behavior to ensure properly escaped values.  As part of this exercise, I
generalized the method to allow for other places to benefit from this
behavior.

This generalization also helps ensure that we have a more conformant
rendering (e.g. we should always have an :id, :className, and :name
value in our data-info hash).

_Note: I've updated the user's names for Cypress tests as they are more
likely to catch the particular issue than anything else.  I assume that
I'm going to break some cypress tests and will need some help fixing
them._

Closes #15916, #14704

Supersedes #15983

How to test locally:

Assuming you have seeded database (e.g. `rails db:seed`), checkout the
"main" branch.  Then in `rails console` find a user that's written articles:

```ruby
user = Article.last.user

user.update(name: "\\: #{user.name}")

user.articles.each(&:save)
```

Now, again on the "main" branch, start your application (e.g.,
`bin/startup`).

Then get a logged in and a logged out browser session going.  Open your
web inspector and open console.  Then go to the local instances homepage
(e.g., http://localhost:3000) and look for JS errors.

On the main branch, you should see an exception around
`JSON.parse(button.data.info)` (assuming that the `user`'s article is
rendered on the homepage).

Then go to the user's page (e.g. https://localhost:3000/:user-slug) and
look for JS parse errors.

On this PR's branch (e.g.,
`jeremyf/take-two-at-resolving-gh-15916`)
you shouldn't see those console errors.

More importantly, the Follow buttons should work.
2022-01-14 08:30:49 -05:00
..
ahoy Favoring delete_all on user relationships (#15443) 2021-11-23 11:50:12 -05:00
articles Refactoring to add helper method (#16064) 2022-01-12 11:21:44 -05:00
concerns Remove CustomProfileField (#14286) 2021-07-22 10:05:39 +07:00
liquid_tags [deploy] Add role and docs for user subscription liquid tag (#9170) 2020-07-08 14:07:53 -04:00
settings Convert admin/config text fields with static options to dropdowns (#16094) 2022-01-13 16:15:48 -05:00
users Patching ERB rendering of the data-info JSON (#16067) 2022-01-14 08:30:49 -05:00
ab_experiment.rb Proposing feed experiment 3: More comment count weight (#15993) 2022-01-11 11:05:06 -05:00
admin_menu.rb Remove webhooks and related code (#15827) 2021-12-28 10:56:37 +07:00
announcement.rb Add Polymorphism to Broadcasts (Part 1) (#9231) [deploy] 2020-07-13 09:36:19 -06:00
api_secret.rb Favoring delete_all on user relationships (#15443) 2021-11-23 11:50:12 -05:00
application_record.rb Patching ERB rendering of the data-info JSON (#16067) 2022-01-14 08:30:49 -05:00
article.rb Replacing custom call with existing cached method (#16083) 2022-01-13 07:48:32 -05:00
audit_log.rb Favoring constant over magic string (#15852) 2021-12-27 11:31:29 -05:00
badge.rb Refactor cache purging (#12811) 2021-03-02 10:09:05 -05:00
badge_achievement.rb Extracting container for allowed tags & attrs (#15338) 2021-12-16 12:24:45 -05:00
banished_user.rb Introduce BanishedUser table (#5589) [deploy] 2020-01-21 17:15:58 -05:00
broadcast.rb Fix Rails/HasManyOrHasOneDependent for Broadcast and Collection (#9662) 2020-08-07 14:27:24 -04:00
campaign.rb Refactoring to consolidate logic (#15851) 2021-12-29 11:08:04 -05:00
collection.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
comment.rb Remove htmlentities gem (#15958) 2022-01-06 21:14:32 +07:00
config.rb Add single resource admin concept (#5069) [deploy] 2019-12-11 13:17:55 -05:00
consumer_app.rb Fixes a name conflict in Rpush models (#15978) 2022-01-07 09:38:16 -06:00
creator_setting.rb Creator Onboarding: Creator Setup View (#14728) 2021-11-01 15:50:08 -04:00
credit.rb Favor repurposing existing scope (#15914) 2022-01-03 09:30:34 -05:00
data_update_script.rb Navigation Items and Role access for Data Update Scripts (#12292) 2021-02-09 17:41:14 +02:00
device.rb Spelling (#15702) 2021-12-07 06:59:10 -07:00
discussion_lock.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
display_ad.rb Extracting container for allowed tags & attrs (#15338) 2021-12-16 12:24:45 -05:00
display_ad_event.rb Extracting constants and tidying tests (#15946) 2022-01-05 09:19:39 -05:00
email_authorization.rb Refactor Admin Member Detail view - Tools section (#14283) 2021-08-17 18:55:53 +02:00
email_message.rb Delete old retained emails after certain period (#14949) 2021-10-12 16:27:13 -04:00
feedback_message.rb Refactor Admin Member Detail view - Tools section (#14283) 2021-08-17 18:55:53 +02:00
follow.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
forem_instance.rb Fix Forem Ownership Field (#14730) 2021-09-16 06:56:59 -04:00
github_issue.rb If there is no body of the linked issue or PR, don't render markdown (#14804) 2021-09-28 09:20:49 -05:00
github_repo.rb Refactor cache purging (#12811) 2021-03-02 10:09:05 -05:00
html_variant.rb Strip surrounding whitespace from HTMLVariant name (#15776) 2021-12-14 14:42:06 -05:00
html_variant_success.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
html_variant_trial.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
identity.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
invitation.rb [deploy] Invite users to join and create password (#9294) 2020-07-15 11:37:19 -04:00
listing.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
listing_category.rb [deploy] Manage listing categories in dashboard (#10506) 2020-10-02 11:05:09 -04:00
mention.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
mod.rb Add single resource admin concept (#5069) [deploy] 2019-12-11 13:17:55 -05:00
moderator_action.rb [deploy] Moderator and admin actions log (#6797) 2020-03-26 16:59:24 -05:00
navigation_link.rb Remove redundant freeze calls (#14596) 2021-08-26 10:01:08 -04:00
note.rb Favoring delete_all on user relationships (#15443) 2021-11-23 11:50:12 -05:00
notification.rb Favoring delete_all on user relationships (#15443) 2021-11-23 11:50:12 -05:00
notification_subscription.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
organization.rb Refactoring to add helper method (#16064) 2022-01-12 11:21:44 -05:00
organization_membership.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
overview.rb Add admin overview page (#12726) 2021-03-01 18:59:05 -06:00
page.rb Extracting cross-model uniqueness validator (#15640) 2021-12-06 17:07:47 -05:00
page_view.rb Favoring dependent: :delete_all over :destroy (#15442) 2021-11-24 13:56:16 -05:00
permission.rb Add single resource admin concept (#5069) [deploy] 2019-12-11 13:17:55 -05:00
pinned_article.rb Pin posts to feed (#13807) 2021-06-04 10:54:53 +02:00
podcast.rb Refactoring to add helper method (#16064) 2022-01-12 11:21:44 -05:00
podcast_episode.rb Various cleanups (#14616) 2021-08-31 09:17:24 +07:00
podcast_episode_appearance.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
podcast_ownership.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
poll.rb Refactoring poll/vote/skip logic (#15441) 2021-11-29 10:52:32 -05:00
poll_option.rb Favoring dependent: :delete_all over :destroy (#15442) 2021-11-24 13:56:16 -05:00
poll_skip.rb Refactoring poll/vote/skip logic (#15441) 2021-11-29 10:52:32 -05:00
poll_vote.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
privileged_reaction.rb [deploy] New Feature: Mod Actions Panel (#7777) 2020-06-08 13:24:18 -04:00
profile.rb Remove store_attribute gem (#15923) 2022-01-04 11:15:57 +07:00
profile_field.rb Remove check_box type from profile fields (#14832) 2021-09-30 13:27:39 -04:00
profile_field_group.rb [deploy] /profile/settings page rendering (Ridhwana/Michael) (#10733) 2020-10-20 09:18:13 -04:00
profile_pin.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
rating_vote.rb role deprecation cleanup (#15717) 2021-12-09 15:27:45 -06:00
reaction.rb Remove reactions to a user when deleting the user (#15724) 2021-12-10 11:24:23 -06:00
response_template.rb Deprecating User#trusted in favor of User#trusted? (#15639) 2021-12-02 08:54:58 -05:00
role.rb ✂✂✂ Remove Connect (#14734) 2021-11-18 08:21:00 -06:00
secret.rb [deploy] Feature: Setup Admin Area to Update Vault Secrets (#8935) 2020-06-29 15:08:09 -05:00
sponsorship.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
tag.rb Patching ERB rendering of the data-info JSON (#16067) 2022-01-14 08:30:49 -05:00
tag_adjustment.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
timeframe.rb Remove timeframer from app/labor (#11782) 2020-12-08 12:52:33 +07:00
tool.rb Add single resource admin concept (#5069) [deploy] 2019-12-11 13:17:55 -05:00
tweet.rb RFC 190: Forem Creator Signup Page (#13875) 2021-08-24 10:33:26 +02:00
user.rb Refactoring to add helper method (#16064) 2022-01-12 11:21:44 -05:00
user_block.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
user_role.rb [Search 2.0] Users (#13453) 2021-04-24 19:06:06 +02:00
user_subscription.rb Appeasing Rubocop as it sneaks some changes in (#16085) 2022-01-13 07:48:01 -05:00
welcome.rb Add single resource admin concept (#5069) [deploy] 2019-12-11 13:17:55 -05:00
welcome_notification.rb Add Polymorphism to Broadcasts (Part 1) (#9231) [deploy] 2020-07-13 09:36:19 -06:00