From acb80e3d0e96725fffad7caa42cc33281714450a Mon Sep 17 00:00:00 2001 From: Jeremy Kemper Date: Thu, 13 Oct 2005 22:44:45 +0000 Subject: Escape query strings in the href attribute of URLs created by url_helper. #2333 git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@2572 5ecf4fe2-1ee6-0310-87b1-e25e094e27de --- actionpack/lib/action_view/helpers/url_helper.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'actionpack/lib/action_view/helpers/url_helper.rb') diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 4b7a2270dc..118b5b158b 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -46,7 +46,7 @@ module ActionView else tag_options = nil end - url = options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference) + url = html_escape(options.is_a?(String) ? options : url_for(options, *parameters_for_method_reference)) "#{name||url}" end @@ -107,7 +107,7 @@ module ActionView url, name = options.is_a?(String) ? [ options, name || options ] : - [ url_for(options), name || url_for(options) ] + [ url_for(options), name || html_escape(url_for(options)) ] html_options.merge!("type" => "submit", "value" => name) -- cgit v1.2.3