Fix Flash links (#1549)

Author: damianhxy

app/controllers/assessment/autograde.rb

@@ -98,8 +98,9 @@ def regradeBatch
       end
     end
 
-    if failed_list.length > 0
-      flash[:error] = "Warning: Could not regrade #{failed_list.length} submission(s):<br>"
+    failure_jobs = failed_list.length
+    if failure_jobs > 0
+      flash[:error] = "Warning: Could not regrade #{pluralize(failure_jobs, "submission")}:<br>"
       failed_list.each do |failure|
         if failure[:error].error_code == :nil_submission
           flash[:error] += "Unrecognized submission ID<br>"
@@ -109,12 +110,15 @@ def regradeBatch
       end
     end
 
-    success_jobs = submission_ids.size - failed_list.length
+    success_jobs = submission_ids.size - failure_jobs
     if success_jobs > 0
-      link = "<a href=\"#{url_for(controller: 'jobs')}\">#{success_jobs} submission</a>"
-      flash[:success] = ("Regrading #{link}").html_safe
+      link = "<a href=\"#{url_for(controller: 'jobs')}\">#{pluralize(success_jobs, "submission")}</a>"
+      flash[:success] = ("Regrading #{link}")
     end
 
+    # For both :success and :error
+    flash[:html_safe] = true
+
     redirect_to([@course, @assessment, :submissions]) && return
   end
 
@@ -141,8 +145,9 @@ def regradeAll
       end
     end
 
-    if failed_list.length > 0
-      flash[:error] = "Warning: Could not regrade #{failed_list.length} submission(s):<br>"
+    failure_jobs = failed_list.length
+    if failure_jobs > 0
+      flash[:error] = "Warning: Could not regrade #{pluralize(failure_jobs, "submission")}:<br>"
       failed_list.each do |failure|
         if failure[:error].error_code == :nil_submission
           flash[:error] += "Unrecognized submission ID<br>"
@@ -152,12 +157,15 @@ def regradeAll
       end
     end
 
-    success_jobs = last_submissions.size - failed_list.length
+    success_jobs = last_submissions.size - failure_jobs
     if success_jobs > 0
-      link = "<a href=\"#{url_for(controller: 'jobs')}\">#{success_jobs} students</a>"
-      flash[:success] = ("Regrading the most recent submissions from #{link}").html_safe
+      link = "<a href=\"#{url_for(controller: 'jobs')}\">#{pluralize(success_jobs, "student")}</a>"
+      flash[:success] = ("Regrading the most recent submissions from #{link}")
     end
 
+    # For both :success and :error
+    flash[:html_safe] = true
+
     redirect_to([@course, @assessment, :submissions]) && return
   end
 
@@ -186,6 +194,7 @@ def sendJob_AddHTMLMessages(course, assessment, submissions)
         if @cud.instructor?
           link = (view_context.link_to "Autograder Settings", [:edit, course, assessment, :autograder])
           flash[:error] += " Visit #{link} to set the autograding properties."
+          flash[:html_safe] = true
         else
           flash[:error] += " Please contact your instructor."
         end
@@ -199,6 +208,7 @@ def sendJob_AddHTMLMessages(course, assessment, submissions)
         if @cud.instructor?
           link = (view_context.link_to "Autograder Settings", [:edit, course, assessment, :autograder])
           flash[:error] += " (Verify the autograding properties at #{link}.)\nErrorMsg: " + e.additional_data
+          flash[:html_safe] = true
         end
       when :missing_autograder_file
         flash[:error] = "One or more files are missing in the server. Please contact the instructor. The missing files are: " + e.additional_data
@@ -211,8 +221,8 @@ def sendJob_AddHTMLMessages(course, assessment, submissions)
 
     link = "<a href=\"#{url_for(controller: 'jobs', action: 'getjob', id: job)}\">Job ID = #{job}</a>"
     flash[:success] = ("Submitted file #{submissions[0].filename} (#{link}) for autograding." \
-      " Refresh the page to see the results.").html_safe
-
+      " Refresh the page to see the results.")
+    flash[:html_safe] = true
     job
   end
 

app/controllers/assessment/grading.rb

@@ -164,6 +164,7 @@ def parse_csv(csv, data_type)
     rescue CSV::MalformedCSVError => e
       flash[:error] = "Failed to parse CSV -- make sure the grades " \
                       "are formatted correctly: <pre>#{e}</pre>"
+      flash[:html_safe] = true
       return false, []
     end
 

app/views/layouts/application.html.erb

@@ -68,14 +68,18 @@
 
         <!-- Flashes -->
         <div id="flashes">
-          <!-- Ruby escapes msg by default, no need for sanitization -->
+          <%# msg is escaped by default %>
+          <%# if you must output raw html, set flash[:html_safe] = true in controller %>
+          <% html_safe = flash[:html_safe] %>
+          <% flash.delete(:html_safe) %>
           <% flash.each do |name, msg| %>
             <% if name == "roster_error" %>
               <div class="error" id="flash_error">
                 <%= render :partial=>'courses/uploadError',
                             locals: {roster_errors: msg} %>
               </div>
             <% else %>
+              <% msg = msg.html_safe if html_safe %>
               <%= content_tag :div, msg, id: "flash_#{name}",
                   class: "#{name}" %>
             <% end %>

app/views/layouts/home.html.erb

@@ -45,8 +45,12 @@
 
         <!-- Flashes -->
         <div id="flashes">
-          <!-- Ruby escapes msg by default, no need for sanitization -->
+          <%# msg is escaped by default %>
+          <%# if you must output raw html, set flash[:html_safe] = true in controller %>
+          <% html_safe = flash[:html_safe] %>
+          <% flash.delete(:html_safe) %>
           <% flash.each do |name, msg| %>
+            <% msg = msg.html_safe if html_safe %>
             <%= content_tag :div, msg, id: "flash_#{name}",
                 class: "#{name}" %>
           <% end %>