This project is archived and is in readonly mode.
Problem with XSS escape in select_* (eg: select_month) helpers
-
Michael Koziarski- Tag set to xss
- Milestone set to 2.3.6
-
-
-
-
-
Martin Gamsjaeger (snusnu)I've also added this PATCH link to #4728 Form Helper Escaping Problem and #4762 url_for :escape parameter is ignored . Not sure it applies to any or all of them, but I'm looking through tickets that seem somehow related. Here's a patch I needed to add to rails master to get (at least) the usage of #content_tag with a String as 2nd param working:
PATCH: http://github.com/snusnu/rails/commit/7f1b5bc6452cd1ca65dae3283c4af...
-
-
Santiago Pastorino- State changed from new to open
This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.
Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.
-
Santiago Pastorino
- State changed from open to stale