This project is archived and is in readonly mode.
observe_field should escape the parameter it is submitting
Reported by Frederick Cheung | May 17th, 2008 @ 07:14 PM
The base forms of observe_field wind up with us generating javascript like
parameters: 'q=' + value
value here is just the form elements value, which hasn't been escaped. It should be passed through encodeURIComponent or else the parameters get borked if you type an ampersand in the observed field.
Comments and changes to this ticket
-
Repository May 19th, 2008 @ 10:32 AM
- State changed from “new” to “resolved”
(from [17d1319c480e58e28641b243da50ae5e5eab89dc]) Ensure observe_field encodes value parameter. [#216 state:resolved]
Signed-off-by: Pratik Naik
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
Frederick Cheung
Repository