summaryrefslogtreecommitdiff
path: root/app/views/layouts/admin.html.erb
diff options
context:
space:
mode:
authorerdgeist <erdgeist@erdgeist.org>2026-07-09 15:29:40 +0200
committererdgeist <erdgeist@erdgeist.org>2026-07-09 15:29:40 +0200
commit9c3217df50d462d6be4399e3e654d591bf704df7 (patch)
tree627e474b273789667bca9eadffa0e7f626d002bb /app/views/layouts/admin.html.erb
parent8310751d4db2854597d6379b24e346c65622972d (diff)
Fix malformed-HTML fallout across RSS, link rewriting, and flash messaging
Editors' TinyMCE output can contain unclosed void elements like <br>, which is valid HTML5 but invalid XML -- three different places assumed the stricter rule and broke or silently misbehaved on the looser one. The Atom feed's <content type="xhtml"> block required real, well-formed XML structure but was handed a raw, unescaped body string; switched to type="html" with CGI.escapeHTML, matching how title/summary already handle the same content. rewrite_links_in_body used libxml's strict XML parser to rewrite internal links to be locale-prefixed, which raised on exactly this class of malformed markup -- silently, since the whole method was wrapped in rescue; nil, meaning the link rewrite (not the save) quietly failed with no error anywhere. Replaced with Nokogiri's lenient HTML parser, which repairs malformed void elements rather than rejecting them; also drops the bare rescue now that the actual failure mode it was guarding against shouldn't occur, and fixes two adjacent bugs found while in this method: a typo'd /sytem/uploads/ regex that could never match, and a missing https:// exclusion alongside the existing http:// one. Also addresses stale flash messaging surfaced while testing the above: update's save confirmation was being clobbered by edit's own "locked and ready" notice on the very next request, since nothing distinguished a fresh lock acquisition from a redirect back after saving. The save confirmation now names the next step (publish from Status) and flags a stale translation if one exists, using Page#outdated_translations?, already present but previously unused by any controller.
Diffstat (limited to 'app/views/layouts/admin.html.erb')
-rw-r--r--app/views/layouts/admin.html.erb7
1 files changed, 7 insertions, 0 deletions
diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb
index 340eaf2..79b1380 100644
--- a/app/views/layouts/admin.html.erb
+++ b/app/views/layouts/admin.html.erb
@@ -33,6 +33,13 @@
33 <% if flash[:notice].present? || flash[:error].present? %> 33 <% if flash[:notice].present? || flash[:error].present? %>
34 <div id="flash"> 34 <div id="flash">
35 <%= flash[:notice] %> 35 <%= flash[:notice] %>
36 <% if flash[:status_path] %>
37 <%= link_to 'Go to Status', flash[:status_path] %>
38 <% end %>
39 <% if flash[:stale_locale_path] %>
40 The <%= flash[:stale_locale] %> translation may be out of date —
41 <%= link_to 'review it', flash[:stale_locale_path] %> too.
42 <% end %>
36 <% if flash[:error] %> 43 <% if flash[:error] %>
37 <span id="flash_error"><%= flash[:error] %></span> 44 <span id="flash_error"><%= flash[:error] %></span>
38 <% end %> 45 <% end %>