This project is archived and is in readonly mode.
:include_blank and :prompt options for #select not HTML safe
Reported by John Firebaugh | July 12th, 2010 @ 08:36 PM | in 3.x
String options :include_blank and :prompt options are not HTML-escaped or checked for safety before being concatenated with markup.
select("post", "person_id", Person.all.collect {|p| [ p.name, p.id ] }, {:include_blank => '<None>'})
produces:
<select name="post[person_id]">
<option value=""><None></option>
<option value="1">David</option>
<option value="2" selected="selected">Sam</option>
<option value="3">Tobias</option>
</select>
It should produce:
<select name="post[person_id]">
<option value=""><None></option>
<option value="1">David</option>
<option value="2" selected="selected">Sam</option>
<option value="3">Tobias</option>
</select>
Comments and changes to this ticket
-
Rohit Arondekar July 13th, 2010 @ 01:30 PM
- Milestone set to “3.x”
- State changed from “new” to “open”
- Tag set to “actionpack, formtaghelper, select”
- Importance changed from “” to “Low”
Can you write a failing test and a patch?
-
Ivan Torres (mexpolk) July 13th, 2010 @ 04:11 PM
- Tag changed from “actionpack, formtaghelper, select” to “actionpack, formoptionshelper, grouped_options_for_select, select”
confirmed... here's the patch
-
Rohit Arondekar July 14th, 2010 @ 01:27 AM
The change looks good but you'll need to add a failing test too.
-
-
Rohit Arondekar July 14th, 2010 @ 12:36 PM
- Assigned user set to “José Valim”
-
Repository July 18th, 2010 @ 10:36 AM
- State changed from “open” to “resolved”
(from [cdfa11409c6196d35e890cf1766e1e2cc6f3d7d7]) select :include_blank or :prompt should return escaped string [#5099 state:resolved]
Signed-off-by: José Valim jose.valim@gmail.com
http://github.com/rails/rails/commit/cdfa11409c6196d35e890cf1766e1e...
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
People watching this ticket
Ivan Torres (mexpolk)
Jeremy Kemper
John Firebaugh
José Valim
Rohit Arondekar
Attachments
Referenced by
-
5099
:include_blank and :prompt options for #select not HTML safe
(from [cdfa11409c6196d35e890cf1766e1e2cc6f3d7d7])
select ...