Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Changeset 3953

Show
Ignore:
Timestamp:
03/18/06 22:36:52 (3 years ago)
Author:
ulysses
Message:

Change url_for to escape the resulting URLs when called from a view. Closes #4202

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/actionpack/CHANGELOG

    r3939 r3953  
    11*SVN* 
     2 
     3* Change url_for to escape the resulting URLs when called from a view. [Nicholas Seckar, eddiewould@paradise.net.nz] 
    24 
    35* Added easy support for testing file uploads with fixture_file_upload #4105 [turnip@turnipspatch.com]. Example: 

  • trunk/actionpack/lib/action_view/helpers/url_helper.rb

    r3937 r3953  
    1616      def url_for(options = {}, *parameters_for_method_reference) 
    1717        options = { :only_path => true }.update(options.symbolize_keys) if options.kind_of? Hash 
    18         @controller.send(:url_for, options, *parameters_for_method_reference) 
     18        html_escape(@controller.send(:url_for, options, *parameters_for_method_reference)) 
    1919      end 
    2020 
    …… 
    4747          tag_options = nil 
    4848        end 
    49         url = html_escape(options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference)) 
    50         "<a href=\"#{url}\"#{tag_options}>#{name||url}</a>" 
     49        url = options.is_a?(String) ? options : self.url_for(options, *parameters_for_method_reference) 
     50        "<a href=\"#{url}\"#{tag_options}>#{name || url}</a>" 
    5151      end 
    5252 
    …… 
    105105          html_options["onclick"] = "return #{confirm_javascript_function(confirm)};" 
    106106        end 
    107  
    108         url, name = options.is_a?(String) ? 
    109           [ options,  name || options ] : 
    110           [ url_for(options), name || html_escape(url_for(options)) ] 
    111  
     107         
     108        url = options.is_a?(String) ? options : url_for(options) 
     109        name ||= url 
     110         
    112111        html_options.merge!("type" => "submit", "value" => name) 
    113112 
    …… 
    198197      #     <a href="mailto:me@domain.com?cc="ccaddress@domain.com"&bcc="bccaddress@domain.com"&body="This%20is%20the%20body%20of%20the%20message."&subject="This%20is%20an%20example%20email">My email</a> 
    199198      def mail_to(email_address, name = nil, html_options = {}) 
     199        name = html_escape(name) if name 
    200200        html_options = html_options.stringify_keys 
    201201        encode = html_options.delete("encode") 

  • trunk/actionpack/test/template/url_helper_test.rb

    r3928 r3953  
    1414  def setup 
    1515    @controller = Class.new do 
     16      attr_accessor :url 
    1617      def url_for(options, *parameters_for_method_reference) 
    17         "http://www.example.com" 
     18        url 
    1819      end 
    1920    end 
    2021    @controller = @controller.new 
    21   end 
    22  
     22    @controller.url = "http://www.example.com" 
     23  end 
     24   
     25  def test_url_for_escapes_urls 
     26    @controller.url = "http://www.example.com?a=b&c=d" 
     27    assert_equal "http://www.example.com?a=b&amp;c=d", url_for(:a => 'b', :c => 'd') 
     28  end 
     29   
    2330  # todo: missing test cases 
    2431  def test_button_to_with_straight_url 
    …… 
    5764 
    5865  def test_link_tag_with_query 
    59     assert_dom_equal "<a href=\"http://www.example.com?q1=v1&amp;q2=v2\">Hello</a>", link_to("Hello", "http://www.example.com?q1=v1&q2=v2") 
     66    assert_dom_equal "<a href=\"http://www.example.com?q1=v1&amp;q2=v2\">Hello</a>", link_to("Hello", "http://www.example.com?q1=v1&amp;q2=v2") 
    6067  end 
    6168 
    6269  def test_link_tag_with_query_and_no_name 
    63     assert_dom_equal "<a href=\"http://www.example.com?q1=v1&amp;q2=v2\">http://www.example.com?q1=v1&amp;q2=v2</a>", link_to(nil, "http://www.example.com?q1=v1&q2=v2") 
     70    assert_dom_equal "<a href=\"http://www.example.com?q1=v1&amp;q2=v2\">http://www.example.com?q1=v1&amp;q2=v2</a>", link_to(nil, "http://www.example.com?q1=v1&amp;q2=v2") 
     71  end 
     72 
     73  def test_link_tag_with_img 
     74    assert_dom_equal "<a href=\"http://www.example.com\"><img src='/favicon.jpg' /></a>", link_to("<img src='/favicon.jpg' />", "http://www.example.com") 
     75  end 
     76 
     77  def test_link_with_nil_html_options 
     78    assert_dom_equal "<a href=\"http://www.example.com\">Hello</a>", link_to("Hello", {:action => 'myaction'}, nil) 
    6479  end 
    6580 
    …… 
    6782    assert_dom_equal "<a href=\"http://www.example.com\" onclick=\"alert('yay!')\">Hello</a>", link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')") 
    6883  end 
    69  
     84   
    7085  def test_link_tag_with_javascript_confirm 
    7186    assert_dom_equal( 
    …… 
    148163  end 
    149164 
    150  
    151165  def xtest_link_unless_current 
    152166    @request = RequestMock.new("http://www.example.com") 
    …… 
    158172    assert_equal "Showing", link_to_unless_current("Showing", :action => "show", :controller => "weblog", :id => 1) 
    159173  end 
    160  
     174   
    161175  def test_mail_to 
    162176    assert_dom_equal "<a href=\"mailto:david@loudthinking.com\">david@loudthinking.com</a>", mail_to("david@loudthinking.com") 
    …… 
    192206    assert_dom_equal "<script type=\"text/javascript\">eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%64%6f%6d%61%69%6e%2e%63%6f%6d%22%3e%4d%79%20%65%6d%61%69%6c%3c%2f%61%3e%27%29%3b'))</script>", mail_to("me@domain.com", "My email", :encode => "javascript", :replace_at => "(at)", :replace_dot => "(dot)") 
    193207  end 
    194  
    195   def test_link_with_nil_html_options 
    196     assert_dom_equal "<a href=\"http://www.example.com\">Hello</a>", link_to("Hello", {:action => 'myaction'}, nil) 
    197   end 
    198208end