diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG index 1f33d22e56..0e20b46fbb 100644 --- a/actionpack/CHANGELOG +++ b/actionpack/CHANGELOG @@ -1,5 +1,7 @@ *SVN* +* Escape query strings in the href attribute of URLs created by url_helper. #2333 [Michael Schuerig ] + * Improved line number reporting for template errors [Nicholas Seckar] * Added :locals support for render :inline #2463 [mdabney@cavoksolutions.com] diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 4b7a2270dc..118b5b158b 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -46,7 +46,7 @@ module ActionView else tag_options = nil end - url = options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference) + url = html_escape(options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference)) "#{name||url}" end @@ -107,7 +107,7 @@ module ActionView url, name = options.is_a?(String) ? [ options, name || options ] : - [ url_for(options), name || url_for(options) ] + [ url_for(options), name || html_escape(url_for(options)) ] html_options.merge!("type" => "submit", "value" => name) diff --git a/actionpack/test/template/url_helper_test.rb b/actionpack/test/template/url_helper_test.rb index e85f710c44..78ad185542 100644 --- a/actionpack/test/template/url_helper_test.rb +++ b/actionpack/test/template/url_helper_test.rb @@ -25,6 +25,14 @@ class UrlHelperTest < Test::Unit::TestCase assert_dom_equal "
", button_to("Hello", "http://www.example.com") end + def test_button_to_with_query + assert_dom_equal "
", button_to("Hello", "http://www.example.com/q1=v1&q2=v2") + end + + def test_button_to_with_query_and_no_name + assert_dom_equal "
", button_to(nil, "http://www.example.com?q1=v1&q2=v2") + end + def test_button_to_with_javascript_confirm assert_dom_equal( "
", @@ -47,6 +55,14 @@ class UrlHelperTest < Test::Unit::TestCase assert_dom_equal "Hello", link_to("Hello", "http://www.example.com") end + def test_link_tag_with_query + assert_dom_equal "Hello", link_to("Hello", "http://www.example.com?q1=v1&q2=v2") + end + + def test_link_tag_with_query_and_no_name + assert_dom_equal "http://www.example.com?q1=v1&q2=v2", link_to(nil, "http://www.example.com?q1=v1&q2=v2") + end + def test_link_tag_with_custom_onclick assert_dom_equal "Hello", link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')") end