From 8910de6a54324b38b6a20ab93c870e3146fd3a37 Mon Sep 17 00:00:00 2001 From: Jamis Buck Date: Sun, 14 Aug 2005 08:43:07 +0000 Subject: Make link_to escape the javascript in the confirm option #1964 [nicolas.pouillard@gmail.com] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@2009 5ecf4fe2-1ee6-0310-87b1-e25e094e27de --- actionpack/lib/action_view/helpers/url_helper.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'actionpack/lib/action_view/helpers/url_helper.rb') diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 4864e253a8..5bcfb5e75d 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -1,3 +1,5 @@ +require File.dirname(__FILE__) + '/javascript_helper' + module ActionView module Helpers # Provides a set of methods for making easy links and getting urls that depend on the controller and action. This means that @@ -5,6 +7,8 @@ module ActionView # synchronously, so link_to uses that same url as is generated by url_for, which again is the same url used for # redirection in redirect_to. module UrlHelper + include JavaScriptHelper + # Returns the URL for the set of +options+ provided. This takes the same options # as url_for. For a list, see the url_for documentation in link:classes/ActionController/Base.html#M000079. def url_for(options = {}, *parameters_for_method_reference) @@ -219,7 +223,7 @@ module ActionView private def convert_confirm_option_to_javascript!(html_options) if confirm = html_options.delete("confirm") - html_options["onclick"] = "return confirm('#{confirm.gsub(/'/, '\\\\\'')}');" + html_options["onclick"] = "return confirm('#{escape_javascript(confirm)}');" end end -- cgit v1.2.3