Merge pull request #447 from edison/master

Escape HTML tags for inline field errors

lib/simple_form/components/errors.rb

@@ -12,7 +12,7 @@ module SimpleForm
       protected
 
       def error_text
-        "#{options[:error_prefix]} #{errors.send(error_method)}".lstrip
+        "#{options[:error_prefix]} #{errors.send(error_method)}".lstrip.html_safe
       end
 
       def error_method

lib/simple_form/error_notification.rb

@@ -25,7 +25,7 @@ module SimpleForm
     end
 
     def error_message
-      @message || translate_error_notification
+      (@message || translate_error_notification).html_safe
     end
 
     def error_notification_tag

test/form_builder/error_notification_test.rb

@@ -60,4 +60,10 @@ class ErrorNotificationTest < ActionView::TestCase
       assert_select 'div.error_notification'
     end
   end
+
+  test 'error notification should contain HTML tags' do
+    with_error_notification_for @user, :message => 'Erro encontrado ao criar <b>usuario</b>'
+    assert_select 'p.error_notification', 'Erro encontrado ao criar usuario'
+    assert_select 'p.error_notification b', 'usuario'
+  end
 end

test/form_builder/error_test.rb

@@ -73,6 +73,12 @@ class ErrorTest < ActionView::TestCase
     assert_no_select 'p.error[error_method]'
   end
 
+  test 'error should generate an error message with raw HTML tags' do
+    with_error_for @user, :name, :error_prefix => '<b>Name</b>'
+    assert_select 'span.error', "Name can't be blank"
+    assert_select 'span.error b', "Name"
+  end
+
   # FULL ERRORS
 
   test 'full error should generate an full error tag for the attribute' do