Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Merge pull request #10971 from dtaniwaki/escape_link_to_unless

Always escape the result of link_to_unless method
  • Loading branch information...
commit 2553bd785c0b41193257851ac0267515ec3c9dc3 1 parent 119f27c
@rafaelfranca rafaelfranca authored
View
2  actionpack/lib/action_view/helpers/url_helper.rb
@@ -422,7 +422,7 @@ def link_to_unless(condition, name, options = {}, html_options = {}, &block)
if block_given?
block.arity <= 1 ? capture(name, &block) : capture(name, options, html_options, &block)
else
- name
+ ERB::Util.html_escape(name)
end
else
link_to(name, options, html_options)
View
5 actionpack/test/template/url_helper_test.rb
@@ -306,6 +306,11 @@ def test_link_to_unless
link_to_unless(true, "Showing", url_hash) {
"test"
}
+
+ assert_equal %{&lt;b&gt;Showing&lt;/b&gt;}, link_to_unless(true, "<b>Showing</b>", url_hash)
+ assert_equal %{<a href="/">&lt;b&gt;Showing&lt;/b&gt;</a>}, link_to_unless(false, "<b>Showing</b>", url_hash)
+ assert_equal %{<b>Showing</b>}, link_to_unless(true, "<b>Showing</b>".html_safe, url_hash)
+ assert_equal %{<a href="/"><b>Showing</b></a>}, link_to_unless(false, "<b>Showing</b>".html_safe, url_hash)
end
def test_link_to_if
Please sign in to comment.
Something went wrong with that request. Please try again.