Lipsiasoft / lipsiadmin

When I try to save an object and there is an error, if the error string contains a single quote, then there is a Javascript error.

The bug is that simple_error_messages_for does not properly escape single quote's.

Here is my solution:

Add a javascript_escape helper that escapes single quote to \x27 and (double quote to \x22 to be safe).

module Lipsiadmin
  module View
    module Helpers
      module BackendHelper

        def javascript_escape(msg)
          msg = ERB::Util.html_escape(msg)
          msg.gsub!(/'/, "\\x27")
          msg.gsub!(/"/, "\\x22")
          msg
        end

        # This method work like builtin Rails error_message_for but use an Ext.Message.show({..})
        def simple_error_messages_for(*params)
          options = params.extract_options!.symbolize_keys

          if object = options.delete(:object)
            objects = [object].flatten
          else
            objects = params.collect {|object_name| instance_variable_get("@#{object_name}") }.compact
          end

          count  = objects.inject(0) {|sum, object| sum + object.errors.count }
          unless count.zero?
            html = {}
            [:id, :class].each do |key|
              if options.include?(key)
                value = options[key]
                html[key] = value unless value.blank?
              else
                html[key] = 'errorExplanation'
              end
            end
            options[:object_name] ||= params.first

            I18n.with_options :locale => options[:locale], :scope => [:activerecord, :errors, :template] do |locale|
              header_message = if options.include?(:header_message)
                javascript_escape(options[:header_message])
              else
                object_name = options[:object_name].to_s.gsub('_', ' ')
                object_name = I18n.t(object_name, :default => object_name, :scope => [:activerecord, :models], :count => 1)
                locale.t :header, :count => count, :model => object_name
              end
              message = options.include?(:message) ? options[:message] : locale.t(:body)
              error_messages = objects.sum {|object| object.errors.full_messages.map {|msg| content_tag(:li, javascript_escape(msg)) } }.join

              contents = ''
              contents << content_tag(:p, javascript_escape(message)) unless message.blank?
              contents << content_tag(:ul, error_messages, :class => :list)

              content_tag(:script, "Ext.Msg.show({
                          title: '#{header_message}',
                          msg: '<ul>#{contents}</ul>',
                          buttons: Ext.Msg.OK,
                          minWidth: 400 
                        });", :type => Mime::JS)
            end
          else
            ''
          end
        end
      end
    end
  end
end