Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fixed that single quote was not escaped in a UrlHelper#link_to javasc…

…ript confirm #549 [Scott Barron]

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@837 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
  • Loading branch information...
commit 25b656fefa75954cffff119a14cf7650f4f99a92 1 parent eb5ca2e
@dhh dhh authored
View
2  actionpack/CHANGELOG
@@ -1,5 +1,7 @@
*SVN*
+* Fixed that single quote was not escaped in a UrlHelper#link_to javascript confirm #549 [Scott Barron]
+
* Removed the default border on link_image_to (it broke xhtml strict) -- can be specified with :border => 0 #517 [?/caleb]
* Fixed that form helpers would treat string and symbol keys differently in html_options (and possibly create duplicate entries) #112 [bitsweat]
View
2  actionpack/lib/action_view/helpers/url_helper.rb
@@ -138,7 +138,7 @@ def current_page?(options)
private
def convert_confirm_option_to_javascript!(html_options)
if confirm = html_options.delete("confirm")
- html_options["onclick"] = "return confirm('#{confirm}');"
+ html_options["onclick"] = "return confirm('#{confirm.gsub(/'/, '\\\\\'')}');"
end
end
end
View
4 actionpack/test/template/url_helper_test.rb
@@ -27,6 +27,10 @@ def test_link_tag_with_javascript_confirm
"<a href=\"http://www.world.com\" onclick=\"return confirm('Are you sure?');\">Hello</a>",
link_to("Hello", "http://www.world.com", :confirm => "Are you sure?")
)
+ assert_equal(
+ "<a href=\"http://www.world.com\" onclick=\"return confirm('You can\\'t possibly be sure, can you?');\">Hello</a>",
+ link_to("Hello", "http://www.world.com", :confirm => "You can't possibly be sure, can you?")
+ )
end
def test_link_image_to
Please sign in to comment.
Something went wrong with that request. Please try again.