kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Escape query strings in the href attribute of URLs created by url_helper. #2333

Browse source 
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@2572 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
This commit is contained in:
Jeremy Kemper 2005-10-13 22:44:45 +00:00
parent 2cad95d851
commit acb80e3d0e
3 changed files with 20 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
actionpack/CHANGELOG
View file

@ -1,5 +1,7 @@
*SVN*
* Escape query strings in the href attribute of URLs created by url_helper. #2333 [Michael Schuerig <michael@schuerig.de>]
* Improved line number reporting for template errors [Nicholas Seckar]
* Added :locals support for render :inline #2463 [mdabney@cavoksolutions.com]

4
actionpack/lib/action_view/helpers/url_helper.rb
View file

@ -46,7 +46,7 @@ module ActionView
else
tag_options = nil
end
url = options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference)
url = html_escape(options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference))
"<a href=\"#{url}\"#{tag_options}>#{name||url}</a>"
end
@ -107,7 +107,7 @@ module ActionView
url, name = options.is_a?(String) ?
[ options, name || options ] :
[ url_for(options), name || url_for(options) ]
[ url_for(options), name || html_escape(url_for(options)) ]
html_options.merge!("type" => "submit", "value" => name)

16
actionpack/test/template/url_helper_test.rb
View file

@ -25,6 +25,14 @@ class UrlHelperTest < Test::Unit::TestCase
assert_dom_equal "<form method=\"post\" action=\"http://www.example.com\" class=\"button-to\"><div><input type=\"submit\" value=\"Hello\" /></div></form>", button_to("Hello", "http://www.example.com")
end
def test_button_to_with_query
assert_dom_equal "<form method=\"post\" action=\"http://www.example.com/q1=v1&amp;q2=v2\" class=\"button-to\"><div><input type=\"submit\" value=\"Hello\" /></div></form>", button_to("Hello", "http://www.example.com/q1=v1&q2=v2")
end
def test_button_to_with_query_and_no_name
assert_dom_equal "<form method=\"post\" action=\"http://www.example.com?q1=v1&amp;q2=v2\" class=\"button-to\"><div><input type=\"submit\" value=\"http://www.example.com?q1=v1&amp;q2=v2\" /></div></form>", button_to(nil, "http://www.example.com?q1=v1&q2=v2")
end
def test_button_to_with_javascript_confirm
assert_dom_equal(
"<form method=\"post\" action=\"http://www.example.com\" class=\"button-to\"><div><input onclick=\"return confirm('Are you sure?');\" type=\"submit\" value=\"Hello\" /></div></form>",
@ -47,6 +55,14 @@ class UrlHelperTest < Test::Unit::TestCase
assert_dom_equal "<a href=\"http://www.example.com\">Hello</a>", link_to("Hello", "http://www.example.com")
end
def test_link_tag_with_query
assert_dom_equal "<a href=\"http://www.example.com?q1=v1&amp;q2=v2\">Hello</a>", link_to("Hello", "http://www.example.com?q1=v1&q2=v2")
end
def test_link_tag_with_query_and_no_name
assert_dom_equal "<a href=\"http://www.example.com?q1=v1&amp;q2=v2\">http://www.example.com?q1=v1&amp;q2=v2</a>", link_to(nil, "http://www.example.com?q1=v1&q2=v2")
end
def test_link_tag_with_custom_onclick
assert_dom_equal "<a href=\"http://www.example.com\" onclick=\"alert('yay!')\">Hello</a>", link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')")
end