diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG index 80be915407e61ccbc1c1f255b50dbdabedaa2e7d..32aba2091a58ece8242f1cda67c749c62a07fb30 100644 --- a/actionpack/CHANGELOG +++ b/actionpack/CHANGELOG @@ -1,5 +1,7 @@ *Rails 3.0.0 [Release Candidate] (unreleased)* +* link_to, button_to, and tag/tag_options now rely on html_escape instead of escape_once. [fxn] + * url_for returns always unescaped strings, and the :escape option is gone. [fxn] * Added accept-charset parameter and _snowman hidden field to force the contents diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index 7fea5eb055bfb4f6176de70ec01e538078974adf..4c1b751160e1823cf85ef148804b67626f3c078c 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -539,7 +539,7 @@ def html_options_for_form(url_for_options, options, *parameters_for_url) def extra_tags_for_form(html_options) snowman_tag = tag(:input, :type => "hidden", - :name => "_snowman", :value => "☃") + :name => "_snowman", :value => "☃".html_safe) method = html_options.delete("method").to_s diff --git a/actionpack/lib/action_view/helpers/tag_helper.rb b/actionpack/lib/action_view/helpers/tag_helper.rb index d4e8b3d587a128b2c00d60149a6fe1fb98719c2a..5d032b32a7f417d324a767d69ccc506483e8704c 100644 --- a/actionpack/lib/action_view/helpers/tag_helper.rb +++ b/actionpack/lib/action_view/helpers/tag_helper.rb @@ -122,7 +122,7 @@ def tag_options(options, escape = true) attrs << %(#{key}="#{key}") if value elsif !value.nil? final_value = value.is_a?(Array) ? value.join(" ") : value - final_value = escape_once(final_value) if escape + final_value = html_escape(final_value) if escape attrs << %(#{key}="#{final_value}") end end diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 7d1d00d1fab9cece125304d7cdeffd75432b527b..b8d6dc22f284e036ec0c97065a47588759b2ec9b 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -243,7 +243,7 @@ def link_to(*args, &block) tag_options = nil end - href_attr = "href=\"#{escape_once(url)}\"" unless href + href_attr = "href=\"#{html_escape(url)}\"" unless href "#{html_escape(name || url)}".html_safe end end @@ -328,7 +328,7 @@ def button_to(name, options = {}, html_options = {}) html_options.merge!("type" => "submit", "value" => name) - ("