...classes Page and Template. Both contain the same behavior: They have a string field #html which needs to be sanitized (stripped of malicious HTML) before validation: # app/models/page.rb class Page < ApplicationRecord...
...before_validation :sanitize_html private def sanitize_html self.html = Sanitize.clean(html) end end # app/models/template.rb class Template < ApplicationRecord before_validation :sanitize_html private def sanitize_html self.html = Sanitize.clean(html) end
...more intuitive workflow when working with nested attributes in Rails + Unpoly: Without JS With HTML template and JS With HTML template and JS using dynamic Unpoly templates Adding Records via...
= task_form.check_box :_destroy = task_form.label :_destroy, "Remove task" = form.submit Adding nested records via template HTML with JS resources :variant_2_users, only: [:edit, :update] class Variant2UsersController < ApplicationController def edit
Internet Explorer 5+ is aware of conditional comments that let you target HTML for selected versions of IE. For example the HTML below would ask users of IE 6 and...
...a{ :href => 'http://www.mozilla.com/en-US/firefox/' }= 'Firefox' Sometimes you may need to insert semi-conditional HTML that is ignored by IE but interpreted by real browsers, like: <%= stylesheet_link_tag 'screen...
...but you can always just call Oj.dump explicitely). Security warning: Oj does not escape HTML entities in JSON Be aware that Oj.dump is not aware of ActiveSupport's escape_html...
...you can wrap the output of Oj.dump(...) in an escape_json tag to escape HTML entities in Strings: myFunction(<%= escape_json OJ.dump(@data) %>) Earlier Rails versions have an unusable implementation of escape_json (it deletes...
...an arbitrary route in your Rails application that is able to respond with regular HTML and JSON. By sending the specific MIME type in the Accept header, you tell the...
...application to either return HTML (text/html) or JSON (text/json). The problem is that Rails caches the response independently from the specified Accept header. This means that the first request made...
...this easily by using the lang attribute in your views (ERB): ... or in HAML: %html :xmlns => "http://www.w3.org/1999/xhtml", :"xml:lang" => I18n.locale || 'en', :lang => I18n.locale || 'en' Then, in your stylesheet...
...example declare different background-images for all the languages and elements that are involved. html[lang='en'] #header background-image: url(images/header_en.png) html[lang='de'] #header background-image: url(images/header_de.png...
You know those helper methods that just render some HTML but look weird because of content_tags all over the place? You could also use Haml instead. Example
...following helper. def greeting message = ''.html_safe message << 'Welcome to ' message << content_tag(:span, Rails.env, class: 'greeting--location') content_tag :div, message, class: 'greeting' end That looks clumsy and is...
...re-render the view for unchanged content, you don't need to send unchanged HTML over the network. Tip With the default ETag you don't need to care what...
...most Rails application layouts insert randomly rotating CSRF tokens and CSP nonces into the HTML, two requests for the same data state will never produce the same response bytes: ... ... ...
...note = '\u266A' You can use Unicode escape sequences in both single and double quotes. HTML Use an entity: ♪ Ruby 1.9+ In modern Rubies you can use the \u escape...
...single tweet in fact, can be used to allow defining custom elements purely in HTML. This post will expand on the idea, show how the snippet works, and argue for...
...want to actually use this. A nice trick that lets you define "partials" in HTML without any additional rendering technology on the server or client...
Awesome hack by Tim VanFosson:
...select2 input, you can populate it via AJAX in order to not pollute your HTML with lots of elements. All you have to do is to provide the collection in...
You know that you can use jQuery's text() to get an element's contents without any tags.
HAML SASS helpers partials When done, everything is simply compiled to static HTML and CSS, so no need to install anything on your server. If you receive an...
...it is not available for format determination and Rails will set the format to html. Unfortunately, the constraint won't complain in this case and Rails even renders the sitemap.builder...
Under certain (unknown) circumstances, Rails will give localized files an invalid content-type in the Response header. For me, after...
...what you will not be able to use across all clients. See also Designing HTML emails
...package you use) does something like this anywhere: let response = await fetch('/page') let html = await response.text() document.querySelector('#content').innerHTML = html Now the virality of strict-dynamic allows the attacker...
Once Rails knows a given string is html_safe, it will never escape it. However, there may be times when you still need to escape it. Examples are some safe...
...HTML that you pipe through JSON, or the display of an otherwise safe embed snippet. There is no semantically nice way to do this, as even raw and h do...
I prefer using Opera's "User mode" to toggle an outlining of HTML elements quickly. This helps greatly when you want to see the actual dimensions of elements, e.g. for...
Imagine you have a list you want to render inline on large screens, but stacked on small screens. high
REST Client to ask the server for default text/html that way: RestClient.get(site, {:accept => :html...
.../tmp/github.html Paste your markdown Press Ctrl-D to finalize your input Open the generated HTML file and print it.
In Rails, you can very easily send emails with HTML and plaintext bodies. However, if you're trying to debug those using your normal email account, you might be out...
...will simply throw away the plaintext part of your mail, and just save the html part...