diff options
| author | erdgeist <erdgeist@erdgeist.org> | 2026-07-09 15:29:40 +0200 |
|---|---|---|
| committer | erdgeist <erdgeist@erdgeist.org> | 2026-07-09 15:29:40 +0200 |
| commit | 9c3217df50d462d6be4399e3e654d591bf704df7 (patch) | |
| tree | 627e474b273789667bca9eadffa0e7f626d002bb /app/views/layouts/admin.html.erb | |
| parent | 8310751d4db2854597d6379b24e346c65622972d (diff) | |
Fix malformed-HTML fallout across RSS, link rewriting, and flash messaging
Editors' TinyMCE output can contain unclosed void elements like <br>,
which is valid HTML5 but invalid XML -- three different places assumed
the stricter rule and broke or silently misbehaved on the looser one.
The Atom feed's <content type="xhtml"> block required real, well-formed
XML structure but was handed a raw, unescaped body string; switched to
type="html" with CGI.escapeHTML, matching how title/summary already
handle the same content. rewrite_links_in_body used libxml's strict XML
parser to rewrite internal links to be locale-prefixed, which raised on
exactly this class of malformed markup -- silently, since the whole
method was wrapped in rescue; nil, meaning the link rewrite (not the
save) quietly failed with no error anywhere. Replaced with Nokogiri's
lenient HTML parser, which repairs malformed void elements rather than
rejecting them; also drops the bare rescue now that the actual failure
mode it was guarding against shouldn't occur, and fixes two adjacent
bugs found while in this method: a typo'd /sytem/uploads/ regex that
could never match, and a missing https:// exclusion alongside the
existing http:// one.
Also addresses stale flash messaging surfaced while testing the above:
update's save confirmation was being clobbered by edit's own "locked
and ready" notice on the very next request, since nothing distinguished
a fresh lock acquisition from a redirect back after saving. The save
confirmation now names the next step (publish from Status) and flags a
stale translation if one exists, using Page#outdated_translations?,
already present but previously unused by any controller.
Diffstat (limited to 'app/views/layouts/admin.html.erb')
| -rw-r--r-- | app/views/layouts/admin.html.erb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb index 340eaf2..79b1380 100644 --- a/app/views/layouts/admin.html.erb +++ b/app/views/layouts/admin.html.erb | |||
| @@ -33,6 +33,13 @@ | |||
| 33 | <% if flash[:notice].present? || flash[:error].present? %> | 33 | <% if flash[:notice].present? || flash[:error].present? %> |
| 34 | <div id="flash"> | 34 | <div id="flash"> |
| 35 | <%= flash[:notice] %> | 35 | <%= flash[:notice] %> |
| 36 | <% if flash[:status_path] %> | ||
| 37 | <%= link_to 'Go to Status', flash[:status_path] %> | ||
| 38 | <% end %> | ||
| 39 | <% if flash[:stale_locale_path] %> | ||
| 40 | The <%= flash[:stale_locale] %> translation may be out of date — | ||
| 41 | <%= link_to 'review it', flash[:stale_locale_path] %> too. | ||
| 42 | <% end %> | ||
| 36 | <% if flash[:error] %> | 43 | <% if flash[:error] %> |
| 37 | <span id="flash_error"><%= flash[:error] %></span> | 44 | <span id="flash_error"><%= flash[:error] %></span> |
| 38 | <% end %> | 45 | <% end %> |
