diff options
| author | Santiago Pastorino and José Ignacio Costa <santiago+jose@wyeworks.com> | 2010-02-13 19:55:58 -0200 |
|---|---|---|
| committer | Yehuda Katz <yehudakatz@YK.local> | 2010-02-14 12:03:28 -0800 |
| commit | 9f1900ec7a8a27e1a0eeef93e1226c09a79666b5 (patch) | |
| tree | 34a0a6d48fbaa0995db1f84758ad2c4c85ecdebf /actionpack | |
| parent | f86421fb282ff2d209914db736ca64380dab044d (diff) | |
| download | rails-9f1900ec7a8a27e1a0eeef93e1226c09a79666b5.tar.gz rails-9f1900ec7a8a27e1a0eeef93e1226c09a79666b5.tar.bz2 rails-9f1900ec7a8a27e1a0eeef93e1226c09a79666b5.zip | |
html_escape mail_to when encode javascript and not hex
Signed-off-by: Yehuda Katz <yehudakatz@YK.local>
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/lib/action_view/helpers/url_helper.rb | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 88ce2a2c0c..4690161497 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -469,14 +469,12 @@ module ActionView extras << "subject=#{Rack::Utils.escape(subject).gsub("+", "%20")}&" unless subject.nil? extras = "?" << extras.gsub!(/&?$/,"") unless extras.empty? - email_address = email_address.to_s - - email_address_obfuscated = email_address.dup + email_address_obfuscated = html_escape(email_address) email_address_obfuscated.gsub!(/@/, html_options.delete("replace_at")) if html_options.has_key?("replace_at") email_address_obfuscated.gsub!(/\./, html_options.delete("replace_dot")) if html_options.has_key?("replace_dot") if encode == "javascript" - "document.write('#{content_tag("a", name || email_address_obfuscated, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c| + "document.write('#{content_tag("a", name || email_address_obfuscated.html_safe, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c| string << sprintf("%%%x", c) end "<script type=\"#{Mime::JS}\">eval(decodeURIComponent('#{string}'))</script>" @@ -495,7 +493,7 @@ module ActionView end content_tag "a", name || email_address_encoded.html_safe, html_options.merge({ "href" => "#{string}#{extras}" }) else - content_tag "a", name || email_address_obfuscated, html_options.merge({ "href" => "mailto:#{email_address}#{extras}" }) + content_tag "a", name || email_address_obfuscated.html_safe, html_options.merge({ "href" => "mailto:#{email_address}#{extras}" }) end end |