Commit 13239c9a14e32ced6c5a46649dd63338cef6373b
1 parent
9e51355e
Exists in
ratings_minor_fixes
and in
4 other branches
should not escape admin notification
Showing
1 changed file
with
1 additions
and
1 deletions
Show diff stats
plugins/admin_notifications/views/shared/show_notification.html.erb
| @@ -22,7 +22,7 @@ | @@ -22,7 +22,7 @@ | ||
| 22 | <% @notifications.each do |notification| %> | 22 | <% @notifications.each do |notification| %> |
| 23 | <div class="<%= notification.type.gsub("AdminNotificationsPlugin::", "").downcase %> notification" data-notification="<%=notification.id%>" notification-display-popup="<%=notification.display_popup?%>"> | 23 | <div class="<%= notification.type.gsub("AdminNotificationsPlugin::", "").downcase %> notification" data-notification="<%=notification.id%>" notification-display-popup="<%=notification.display_popup?%>"> |
| 24 | <div class="notification-message"> | 24 | <div class="notification-message"> |
| 25 | - <%= AdminNotificationsPlugin::NotificationHelper.substitute_variables(notification.message, current_user) %> | 25 | + <%= AdminNotificationsPlugin::NotificationHelper.substitute_variables(notification.message, current_user).html_safe %> |
| 26 | </div> | 26 | </div> |
| 27 | <% if logged_in? %> | 27 | <% if logged_in? %> |
| 28 | <div class="notification-close" title="<%= _('Do not show anymore') %>"></div> | 28 | <div class="notification-close" title="<%= _('Do not show anymore') %>"></div> |