properly escape username validation error message flash

5b9c4f48 · Mike Greiling · 5c6d3a99 · 5b9c4f48
Commit 5b9c4f48 authored Nov 23, 2016 by Mike Greiling
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

app/views/profiles/update_username.js.haml app/views/profiles/update_username.js.haml +2 -1

No files found.
--- a/app/views/profiles/update_username.js.haml
+++ b/app/views/profiles/update_username.js.haml
@@ -2,5 +2,6 @@
  :plain
    new Flash("Username successfully changed", "notice")
 - else
+  - error = @user.errors.full_messages.first
  :plain
-    new Flash("Username change failed - #{@user.errors.full_messages.first}", "alert")
+    new Flash("Username change failed - #{escape_javascript error.html_safe}", "alert")