```
The code above defines `WebApp::View` and `WebApp::Layout`, to be used for
the `WebApp` views, while `ApiApp::View` and `ApiApp::Layout` have a different
configuration.
### Thread safety
__Lotus::View__ is thread safe during the runtime, but it isn't during the loading process.
Please load the framework as the last thing before your application starts.
Also, be sure that your app provides a thread safe context while it's loaded.
```ruby
Mutex.new.synchronize do
Lotus::View.load!
end
```
After this operation, all the class variables are frozen, in order to prevent accidental modifications at the run time.
**This is not necessary, when Lotus::View is used within a Lotus application.**
### Security
The output of views and presenters is always **autoescaped**.
**ATTENTION:** In order to prevent XSS attacks, please read the instructions below.
Because Lotus::View supports a lot of template engines, the escape happens at the level of the view.
Most of the time everything happens automatically, but there are still some corner cases that need your manual intervention.
#### View autoescape
```ruby
require 'lotus/view'
User = Struct.new(:name)
module Users
class Show
include Lotus::View
def user_name
user.name
end
end
end
# ERB template
# <%= user_name %>
user = User.new("")
# THIS IS USEFUL FOR UNIT TESTING:
template = Lotus::View::Template.new('users/show.html.erb')
view = Users::Show.new(template, user: user)
view.user_name # => "<script>alert('xss')</script>"
# THIS IS THE RENDERING OUTPUT:
Users::Show.render(format: :html, user: user)
# => <script>alert('xss')</script>
```
#### Presenter autoescape
```ruby
require 'lotus/view'
User = Struct.new(:name)
class UserPresenter
include Lotus::Presenter
end
user = User.new("")
presenter = UserPresenter.new(user)
presenter.name # => "<script>alert('xss')</script>"
```
#### Escape entire objects
We have seen that concrete methods in views are automatically escaped.
This is great, but tedious if you need to print a lot of information from a given object.
Imagine you have `user` as part of the view locals.
If you want to use `<%= user.name %>` directly, **you're still vulnerable to XSS attacks**.
You have two alternatives:
* To use a concrete presenter (eg. `UserPresenter`)
* Escape the entire object (see the example below)
Both those solutions allow you to keep the template syntax unchanged, but to have a safer output.
```ruby
require 'lotus/view'
User = Struct.new(:first_name, :last_name)
module Users
class Show
include Lotus::View
def user
_escape locals[:user]
end
end
end
# ERB template:
#
#
# <%= user.first_name %>
#
#
# <%= user.last_name %>
#
first_name = ""
last_name = ""
user = User.new(first_name, last_name)
html = Users::Show.render(format: :html, user: user)
html
# =>
#
# <script>alert('first_name')</script>
#
#
# <script>alert('last_name')</script>
#
```
#### Raw contents
You can use `_raw` to mark an output as safe.
Please note that **this may open your application to XSS attacks.**
#### Raw contents in views
```ruby
require 'lotus/view'
User = Struct.new(:name)
module Users
class Show
include Lotus::View
def user_name
_raw user.name
end
end
end
# ERB template
# <%= user_name %>
user = User.new("")
html = Users::Show.render(format: :html, user: user)
html
# =>
```
#### Raw contents in presenters
```ruby
require 'lotus/view'
User = Struct.new(:name)
class UserPresenter
include Lotus::Presenter
def first_name
_raw @object.first_name
end
end
user = User.new("")
presenter = UserPresenter.new(user)
presenter.name # => ""
```
## Versioning
__Lotus::View__ uses [Semantic Versioning 2.0.0](http://semver.org)
## Contributing
1. Fork it
2. Create your feature branch (`git checkout -b my-new-feature`)
3. Commit your changes (`git commit -am 'Add some feature'`)
4. Push to the branch (`git push origin my-new-feature`)
5. Create new Pull Request
## Copyright
Copyright 2014-2015 Luca Guidi – Released under MIT License