Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

HTML literals passed into tag helpers don't escape

#3213

We are passing values from the database directly into form tag helpers. Users had submitted values that contained HTML entities. The tag helpers did not escape these entities, as it using the escape_once. This behavior is undesired since a user entering data containing HTML literals, then going to the "update" form for that object, not changing anything, then hitting save, will alter the data.

Patch included to fix this behavior.

This ticket accidently posted in the "rails-plugins" project.

Reported by Stephen Judkins · September 15th, 2009 @ 09:19 PM

State: stale
Milestone: none
Assigned to: nobody
Importance: none

Activity

  1. Rohit Arondekar
    Rohit Arondekar
    • State changed from new to stale
    • Importance changed from to

    Marking ticket as stale. If this is still an issue please leave a comment with suggested changes, creating a patch with tests, rebasing an existing patch or just confirming the issue on a latest release or master/branches.

    October 6th, 2010 @ 06:46 AM