From db91caf20b163543e4a81a12e507a188f83b5a9d Mon Sep 17 00:00:00 2001
From: Joenio Costa <joenio@joenio.me>
Date: Mon, 16 May 2016 17:39:44 -0300
Subject: [PATCH] not escape HTML on LinkListBlock edition

---
 app/models/link_list_block.rb                   |  6 ++----
 app/views/box_organizer/_icon_selector.html.erb |  4 +++-
 test/integration/safe_strings_test.rb           | 12 ++++++++++++
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/app/models/link_list_block.rb b/app/models/link_list_block.rb
index 4d5f7b7..1140ba6 100644
--- a/app/models/link_list_block.rb
+++ b/app/models/link_list_block.rb
@@ -81,10 +81,8 @@ class LinkListBlock < Block
     end
   end
 
-  def icons_options
-    ICONS.map do |i|
-      "<span title=\"#{i[1]}\" class=\"icon-#{i[0]}\" onclick=\"changeIcon(this, '#{i[0]}')\"></span>".html_safe
-    end
+  def icons
+    ICONS
   end
 
 end
diff --git a/app/views/box_organizer/_icon_selector.html.erb b/app/views/box_organizer/_icon_selector.html.erb
index 6e608ad..42c3cf0 100644
--- a/app/views/box_organizer/_icon_selector.html.erb
+++ b/app/views/box_organizer/_icon_selector.html.erb
@@ -2,6 +2,8 @@
   <%= hidden_field_tag 'block[links][][icon]', icon %>
   <span class='icon-<%= icon %>' style='display:block; width:16px; height:16px;'></span>
   <div class="icon-selector" style='display:none;'>
-     <%= @block.icons_options.join %>
+    <% @block.icons.map do |i| %>
+      <%= content_tag('span', '', :title => i[1], :class => "icon-#{i[0]}", :onclick => "changeIcon(this, '#{i[0]}')") %>
+    <% end %>
   </div>
 </div>
diff --git a/test/integration/safe_strings_test.rb b/test/integration/safe_strings_test.rb
index 6d24403..7fbd2dc 100644
--- a/test/integration/safe_strings_test.rb
+++ b/test/integration/safe_strings_test.rb
@@ -163,4 +163,16 @@ class SafeStringsTest < ActionDispatch::IntegrationTest
     get url_for(action: :edit, controller: :profile_design, profile: person.identifier, id: block.id)
     assert_select '.block-config-options .image-data-line'
   end
+
+  should 'not escape icons options editing link_list block' do
+    create_user('jimi', :password => 'test', :password_confirmation => 'test').activate
+    profile = Person['jimi']
+    login 'jimi', 'test'
+    profile.blocks.each(&:destroy)
+    profile.boxes.first.blocks << LinkListBlock.new
+    block = profile.boxes.first.blocks.first
+    get "/myprofile/#{profile.identifier}/profile_design/edit/#{block.id}"
+    assert_select '.icon-selector .icon-edit'
+  end
+
 end
--
libgit2 0.21.2