kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Merge pull request #12760 from pseidemann/master

Browse source 
fix simple_format escapes own output when sanitize is set to true
This commit is contained in:
Yves Senn 2013-11-09 04:07:50 -08:00
commit 675304b478
3 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
actionview/CHANGELOG.md
View file

@ -1,6 +1,10 @@
* Fix `simple_format` escapes own output when passing `sanitize: true`
*Paul Seidemann*
* Ensure ActionView::Digestor.cache is correctly cleaned up when
combining recursive templates with ActionView::Resolver.caching = false
*wyaeld*
* Fix `collection_check_boxes` generated hidden input to use the name attribute provided

2
actionview/lib/action_view/helpers/text_helper.rb
View file

@ -268,7 +268,7 @@ module ActionView
content_tag(wrapper_tag, nil, html_options)
else
paragraphs.map! { |paragraph|
content_tag(wrapper_tag, paragraph, html_options, options[:sanitize])
content_tag(wrapper_tag, paragraph, html_options, false)
}.join("\n\n").html_safe
end
end

5
actionview/test/template/text_helper_test.rb
View file

@ -42,6 +42,11 @@ class TextHelperTest < ActionView::TestCase
assert_equal "<p><b> test with unsafe string </b></p>", simple_format("<b> test with unsafe string </b><script>code!</script>")
end
def test_simple_format_should_sanitize_input_when_sanitize_option_is_true
assert_equal '<p><b> test with unsafe string </b></p>',
simple_format('<b> test with unsafe string </b><script>code!</script>', {}, sanitize: true)
end
def test_simple_format_should_not_sanitize_input_when_sanitize_option_is_false
assert_equal "<p><b> test with unsafe string </b><script>code!</script></p>", simple_format("<b> test with unsafe string </b><script>code!</script>", {}, :sanitize => false)
end