<div class="panel panel-default permissions-confirm">
  <div class="panel-heading">
    <h4>Apply changes to contents?<h4>
  </div>
  <div class="panel-body">
      <%= I18n.t("hyrax.upload.change_access_message_html", curation_concern: curation_concern) %>
  </div>
  <div class="form-actions panel-footer">
    <%= button_to I18n.t("hyrax.upload.change_access_yes_message"), hyrax.copy_access_permission_path(curation_concern), class: 'btn btn-primary' %>
    <%= link_to I18n.t("hyrax.upload.change_access_no_message"), [main_app, curation_concern], class: 'btn' %>
  </div>
</div>

<div class="panel panel-default permissions-confirm">
  <div class="panel-heading">
    <h4>Apply changes to contents?<h4>
  </div>
  <div class="panel-body">
      <%= sanitize I18n.t("hyrax.upload.change_access_message_html", curation_concern: curation_concern) %>
  </div>
  <div class="form-actions panel-footer">
    <%= button_to I18n.t("hyrax.upload.change_access_yes_message"), hyrax.copy_access_permission_path(curation_concern), class: 'btn btn-primary' %>
    <%= link_to I18n.t("hyrax.upload.change_access_no_message"), [main_app, curation_concern], class: 'btn' %>
  </div>
</div>

Use `sanitize` to protect formatting in `confirm_access.hmtl.erb`
Use `sanitize` to protect formatting in `confirm_access.hmtl.erb`

An `html_safe` call was removed in #3230. This fixed an outstanding
vulnerability, but broke formatting on the affected page. Using `sanitize`
reinstates the formatting while protecting against injection.
