This project is archived and is in readonly mode.
Problem with attribute escaping (sanitized.rb) +patch
Reported by Kieran P | July 28th, 2008 @ 07:21 AM | in 2.x
When you have a URL with an ampersand in an attribute, it is escape each time you edit that field. What happens over time is the escaped ampersand also get escaped, resulting in something like this:
&
V
&
V
&
V
&
V
etc
When used in conjunction with things like TinyMCE, it makes it impossible to have links (that is, <a href=""> tags with an & in the href attribute) in the body.
(note though that this does happen without TinyMCE, but its more noticeable with TinyMCE because it escapes URLs automatically before it gets to Rails, so the link is broken when a record is made).
I have an attached a simple fix which when applied to my code, fixed all the problems I encountered. Basically, you turn & to & and back to &. How this fixes the issue is already escaped data is changed back, and then re-escaped, preventing escape build up.
Hope this helps.
Comments and changes to this ticket
-
josh October 28th, 2008 @ 04:34 PM
- State changed from “new” to “stale”
Staling out, please reopen if this is still a problem.
-
Kieran P October 28th, 2008 @ 08:30 PM
- Assigned user set to “josh”
The issue still exists. The patch above is still valid.
-
-
John Burmeister October 30th, 2008 @ 12:17 AM
- Tag changed from “2.1, actionpack, bug, patch, sanitized, tiny” to “2.1, 2.2, actionpack, bug, patch, sanitize, sanitized, tiny”
Patch works great, please fix. +1
-
josh November 2nd, 2008 @ 04:19 PM
- State changed from “stale” to “open”
- Assigned user cleared.
-
theflow November 6th, 2008 @ 11:14 AM
this is duplicate of #683 (which proposes the same solution and includes a test)
-
Pratik March 6th, 2009 @ 07:21 PM
- State changed from “open” to “duplicate”
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
John Burmeister
josh
Pratik