Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Fix failing tests and use new hash style in deprecation messages | Carlos Antonio da Silva | 2012-10-29 | 1 | -9/+9 |
| | |||||
* | Update some code styles. | Rafael Mendonça França | 2012-10-06 | 1 | -150/+180 |
| | | | | | * Uses the Ruby 1.9 hash syntax * Avoid escaping " inside string using the %{} syntax | ||||
* | Accept :remote as symbol in link_to options | Riley Lynch | 2012-10-06 | 1 | -0/+14 |
| | | | | | Accept either :remote or 'remote' in both the html_options and (url_)options hash arguments to link_to. | ||||
* | ' dates back to SGML when ' was introduced in HTML 4.0 | Kalys Osmonov | 2012-09-09 | 1 | -1/+1 |
| | |||||
* | Don't require action_dispatch in ActionView::UrlHelpers | Piotr Sarnacki | 2012-08-28 | 1 | -1/+1 |
| | | | | | | | | | | ActionDispatch::Routing::UrlFor was always required in UrlHelpers. This was changed by splitting previous implementation of UrlHelper into 2 modules: ActionView::Helpers::UrlHelper and ActionView::Routing::UrlHelper. The former one keeps only basic implementation of url_for. The latter adds features that allow to use routes and is only required when url_helpers or mounted_helpers are required. | ||||
* | Don't use `html_escape` to test the escaping | Rafael Mendonça França | 2012-08-05 | 1 | -1/+1 |
| | |||||
* | html_escape should escape single quotes | Santiago Pastorino | 2012-07-31 | 1 | -9/+9 |
| | | | | | https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content Closes #7215 | ||||
* | Add back `:disable_with` and change deprecation horizon to 4.1 | Carlos Galdino + Rafael Mendonça França | 2012-07-21 | 1 | -1/+26 |
| | |||||
* | Add back `:confirm` and change deprecation horizon to 4.1 | Carlos Galdino + Rafael Mendonça França | 2012-07-21 | 1 | -0/+58 |
| | |||||
* | Remove `:confirm` in favor of `:data => { :confirm => 'Text' }` option | Carlos Galdino | 2012-07-18 | 1 | -7/+7 |
| | | | | | | | | | This applies to the following helpers: `button_to` `button_tag` `image_submit_tag` `link_to` `submit_tag` | ||||
* | Simplify link_to using content_tag | Carlos Antonio da Silva | 2012-05-31 | 1 | -0/+20 |
| | | | | Add some tests for link_to with blocks and escaping content. | ||||
* | accept a block in button_to helper | Sergey Nartimov | 2012-05-30 | 1 | -0/+7 |
| | | | | | | | | | | | | | | | | Make possible to use a block in button_to helper if button text is hard to fit into the name parameter, e.g.: <%= button_to [:make_happy, @user] do %> Make happy <strong><%= @user.name %></strong> <% end %> # => "<form method="post" action="/users/1/make_happy" class="button_to"> # <div> # <button type="submit"> # Make happy <strong>Name</strong> # </button> # </div> # </form>" | ||||
* | Revert "Revert "Remove `:disable_with` in favor of `'data-disable-with'` ↵ | José Valim | 2012-05-15 | 1 | -15/+1 |
| | | | | | | | | | option from `submit_tag`, `button_tag` and `button_to` helpers."" Finally remove `:disable_with` but use `:data => { :disable_with => ... }` in examples to show off a better API (which looks nicer in Ruby 1.9) This reverts commit a5c38a9c087e33d36397afc496be7c8e01b37ef0. | ||||
* | Revert "Remove `:disable_with` in favor of `'data-disable-with'` option from ↵ | José Valim | 2012-05-15 | 1 | -1/+15 |
| | | | | | | | | | | `submit_tag`, `button_tag` and `button_to` helpers." `disable_with:` is much easier to type than `"data-disable-with" =>`, and the fact it uses "data-disable-with" => is an implementation concern, it should not affect the public API. This reverts commit 683fc4db00f496e5225928afb4d4e932e0fcdc48. | ||||
* | Remove `:disable_with` in favor of `'data-disable-with'` option from ↵ | Carlos Galdino + Rafael Mendonça França | 2012-05-14 | 1 | -15/+1 |
| | | | | `submit_tag`, `button_tag` and `button_to` helpers. | ||||
* | Remove default match without specified method | Jose and Yehuda | 2012-04-24 | 1 | -9/+9 |
| | | | | | | | | | | | | | | | | In the current router DSL, using the +match+ DSL method will match all verbs for the path to the specified endpoint. In the vast majority of cases, people are currently using +match+ when they actually mean +get+. This introduces security implications. This commit disallows calling +match+ without an HTTP verb constraint by default. To explicitly match all verbs, this commit also adds a :via => :all option to +match+. Closes #5964 | ||||
* | default_url_options does not receive one argument anymore | Rafael Mendonça França | 2012-04-08 | 1 | -1/+1 |
| | |||||
* | Remove unnecessary in HTML 5 type attribute with default value | Andrey A.I. Sitnik | 2012-04-05 | 1 | -4/+4 |
| | |||||
* | removed unnecessary code | ganesh | 2012-02-09 | 1 | -1/+0 |
| | |||||
* | Change OrderedHash with array options to simple hash usage | Carlos Antonio da Silva | 2012-01-25 | 1 | -8/+8 |
| | |||||
* | Refactor button_to helper to use token_tag method | Rafael Mendonça França | 2012-01-19 | 1 | -3/+24 |
| | |||||
* | Remove rescue_action from compatibility module and tests | Carlos Antonio da Silva | 2012-01-17 | 1 | -9/+1 |
| | |||||
* | Make button_to helper support "form" option which is the form attributes. | Wen-Tien Chang | 2011-09-29 | 1 | -0/+4 |
| | |||||
* | current_page? returns false for non-GET requests | Alexey Vakhov | 2011-09-02 | 1 | -2/+8 |
| | |||||
* | Fix a wrong assertion on url_helper_test, and refactor `html_safe` test to ↵ | Prem Sichanugrist | 2011-07-17 | 1 | -2/+6 |
| | | | | be in its method | ||||
* | Adds a test to check link_to with method & rel options | Josh | 2011-06-21 | 1 | -0/+7 |
| | |||||
* | Define ActiveSupport#to_param as to_str - closes #1663 | Andrew White | 2011-06-12 | 1 | -0/+8 |
| | |||||
* | Prepare the context in URLHelperTest so that there are no required ↵ | wycats | 2011-05-22 | 1 | -0/+2 |
| | | | | uninitialized instance variables | ||||
* | Remove dependency from _template. | José Valim | 2011-05-01 | 1 | -1/+1 |
| | |||||
* | Be sure to javascript_escape the email address to prevent apostrophes ↵ | Michael Koziarski | 2011-02-08 | 1 | -4/+5 |
| | | | | | | inadvertently causing javascript errors. This fixes CVE-2011-0446 | ||||
* | add test to check class is being escaped in form_class | Santiago Pastorino | 2011-02-01 | 1 | -0/+4 |
| | |||||
* | Allow customization of form class for button_to | Andrei Bocan | 2011-02-01 | 1 | -0/+4 |
| | | | | Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
* | Make sure capture's output gets html_escaped [#5545 state:resolved] | Jeff Kreeftmeijer | 2010-11-02 | 1 | -6/+1 |
| | | | | | | | Also remove a duplicate test_link_to_unless assertion and add .html_safe to the remaining one. Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
* | Allow generated url helpers to be overriden [#5243 state:resolved] | Andrew White | 2010-10-26 | 1 | -0/+18 |
| | |||||
* | data-disable-with in button_to helper | Paco Guzman | 2010-10-11 | 1 | -0/+21 |
| | | | | | | [#4993 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
* | Clean up unused methods from AV::Base and pass in the template object on ↵ | José Valim | 2010-10-10 | 1 | -1/+1 |
| | | | | rendering. | ||||
* | delete repeated code | Aaron Patterson | 2010-10-01 | 1 | -18/+0 |
| | |||||
* | Removed deprecated RouteSet API, still many tests fail | Piotr Sarnacki | 2010-09-05 | 1 | -3/+2 |
| | |||||
* | Removing unnecessary code | Thiago Pradi | 2010-09-02 | 1 | -7/+0 |
| | | | | Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | Deletes trailing whitespaces (over text files only find * -type f -exec sed ↵ | Santiago Pastorino | 2010-08-14 | 1 | -2/+2 |
| | | | | 's/[ \t]*$//' -i {} \;) | ||||
* | These tests are trusting in the order of the elements so use OrderedHash ↵ | Santiago Pastorino | 2010-07-21 | 1 | -13/+9 |
| | | | | instead of Hash | ||||
* | Refactor recall parameter normalization [#5021 state:resolved] | Andrew White | 2010-07-03 | 1 | -2/+27 |
| | | | | Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | We are trying to test that & escapes here not that & is being escaped, ↵ | Santiago Pastorino | 2010-06-29 | 1 | -3/+2 |
| | | | | | | also added a cosmetic change to test_link_tag_with_query_and_no_name Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net> | ||||
* | s/escape_once/html_escape/, since html safety is the contract that now says ↵ | Xavier Noria | 2010-06-30 | 1 | -2/+2 |
| | | | | whether something has to be escaped | ||||
* | url_for no longer escapes HTML, the :escape option is also gone | Xavier Noria | 2010-06-30 | 1 | -16/+4 |
| | | | | Rationale: url_for is just a path/URL generator, it is the responsability of the caller to escape conveniently HTML needs it, JavaScript needs different escaping, a text mail needs no escaping at all, etc. | ||||
* | Restores the escaping of urls generated from hashes. [#4765 state:resolved] | Andrew White | 2010-06-28 | 1 | -8/+4 |
| | | | | | | | | | | | | | | HTML specifications recommend the escaping of urls in web pages, which url_for does by default for string urls and consquently urls generated by path helpers as these return strings. Hashes passed to url_for are not escaped by default and this commit reverses this default so that they are escaped. Undoes the changes of this commit: http://github.com/rails/rails/commit/1b3195b63ca44f0a70b61b75fcf4991cb2fbb944 Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | Normalize recall params when the route is not a standard route otherwise ↵ | Andrew White | 2010-06-27 | 1 | -0/+22 |
| | | | | | | :controller and :action may appear in the generated url [#4326 state:resolved] Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | Allow :remote => false to be passed to link_to | Nicolas Sanguinetti | 2010-04-22 | 1 | -0/+14 |
| | | | | | | | And add tests for `button_to` and `form_tag` which currently behave as expected, so we avoid a regression. Signed-off-by: wycats <wycats@gmail.com> | ||||
* | params already has a setted controller and action here | Santiago Pastorino | 2010-04-21 | 1 | -1/+0 |
| | | | | Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net> | ||||
* | url_for now works with HashWithIndifferentAccess ht jay [#4391 state:committed] | Santiago Pastorino | 2010-04-21 | 1 | -0/+10 |
| | | | | Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net> |