rails / rails fork watch download tarball
public
Forks677Right
Watchers3838Right
Description: Ruby on Rails
Homepage: http://rubyonrails.org
Clone URL: git://github.com/rails/rails.git 
Ensure mail_to label is obfuscated for javascript encoding. [#294 
state:resolved]

Signed-off-by: Pratik Naik <pratiknaik@gmail.com>
js (author)
Fri Jul 11 16:57:38 -0700 2008
lifo (committer)
Fri Jul 11 17:04:18 -0700 2008
commit  50b5c6845ed1645cf25613024ef04187385f8dcd
tree    3f0b636fb08e8b826ba00950fa7d59234bd454ca
parent  5e2e1ed9ffc481a91596d8c3fd9a68d7977e75ca
0
actionpack/lib/action_view/helpers/url_helper.rb 
...
466
467
468
469
 
470
471
472
 
...
466
467
468
 
469
470
471
472
 
0
@@ -466,7 +466,7 @@ module ActionView
0
         email_address_obfuscated.gsub!(/\./, html_options.delete("replace_dot")) if html_options.has_key?("replace_dot")
0
 
0
         if encode == "javascript"
0
-          "document.write('#{content_tag("a", name || email_address, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c|
0
+          "document.write('#{content_tag("a", name || email_address_obfuscated, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c|
0
             string << sprintf("%%%x", c)
0
           end
0
           "<script type=\"#{Mime::JS}\">eval(unescape('#{string}'))</script>"
0
actionpack/test/template/url_helper_test.rb 
...
292
293
294
 
295
296
297
 
...
292
293
294
295
296
297
298
 
0
@@ -292,6 +292,7 @@ class UrlHelperTest < ActionView::TestCase
0
     assert_dom_equal "<a href=\"&#109;&#97;&#105;&#108;&#116;&#111;&#58;%6d%65@%64%6f%6d%61%69%6e.%63%6f%6d\">My email</a>", mail_to("me@domain.com", "My email", :encode => "hex", :replace_at => "(at)")
0
     assert_dom_equal "<a href=\"&#109;&#97;&#105;&#108;&#116;&#111;&#58;%6d%65@%64%6f%6d%61%69%6e.%63%6f%6d\">&#109;&#101;&#40;&#97;&#116;&#41;&#100;&#111;&#109;&#97;&#105;&#110;&#40;&#100;&#111;&#116;&#41;&#99;&#111;&#109;</a>", mail_to("me@domain.com", nil, :encode => "hex", :replace_at => "(at)", :replace_dot => "(dot)")
0
     assert_dom_equal "<script type=\"text/javascript\">eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%64%6f%6d%61%69%6e%2e%63%6f%6d%22%3e%4d%79%20%65%6d%61%69%6c%3c%2f%61%3e%27%29%3b'))</script>", mail_to("me@domain.com", "My email", :encode => "javascript", :replace_at => "(at)", :replace_dot => "(dot)")
0
+    assert_dom_equal "<script type=\"text/javascript\">eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%64%6f%6d%61%69%6e%2e%63%6f%6d%22%3e%6d%65%28%61%74%29%64%6f%6d%61%69%6e%28%64%6f%74%29%63%6f%6d%3c%2f%61%3e%27%29%3b'))</script>", mail_to("me@domain.com", nil, :encode => "javascript", :replace_at => "(at)", :replace_dot => "(dot)")
0
   end
0
 
0
   def protect_against_forgery?

Comments