Commit 6ca74255f86402b7d46142319fb11a8b7f54cff8
1 parent
e9508301
Exists in
master
and in
22 other branches
rails3: fix json escape for profile views
Showing
8 changed files
with
8 additions
and
8 deletions
Show diff stats
app/views/profile/_comment.html.erb
@@ -46,7 +46,7 @@ | @@ -46,7 +46,7 @@ | ||
46 | 46 | ||
47 | <% if logged_in? && (user == profile || user == comment.author || user.has_permission?(:moderate_comments, profile)) %> | 47 | <% if logged_in? && (user == profile || user == comment.author || user.has_permission?(:moderate_comments, profile)) %> |
48 | <% button_bar(:style => 'float: right; margin-top: 0px;') do %> | 48 | <% button_bar(:style => 'float: right; margin-top: 0px;') do %> |
49 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.article-comment'", url_for(:profile => params[:profile], :action => :remove_comment, :comment_id => comment.id, :view => params[:view]).to_json, _('Are you sure you want to remove this comment and all its replies?').to_json], :class => 'button icon-button icon-delete') %> | 49 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.article-comment'", j(url_for(:profile => params[:profile], :action => :remove_comment, :comment_id => comment.id, :view => params[:view]).to_json), _('Are you sure you want to remove this comment and all its replies?').to_json], :class => 'button icon-button icon-delete') %> |
50 | <% end %> | 50 | <% end %> |
51 | <% end %> | 51 | <% end %> |
52 | <br style="clear: both;" /> | 52 | <br style="clear: both;" /> |
app/views/profile/_create_article.html.erb
@@ -15,7 +15,7 @@ | @@ -15,7 +15,7 @@ | ||
15 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> | 15 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> |
16 | <div class='profile-wall-actions'> | 16 | <div class='profile-wall-actions'> |
17 | <%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %> | 17 | <%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %> |
18 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :only_hide => true, :view => params[:view]).to_json, _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> | 18 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :only_hide => true, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> |
19 | </div> | 19 | </div> |
20 | </div> | 20 | </div> |
21 | 21 |
app/views/profile/_default_activity.html.erb
@@ -6,7 +6,7 @@ | @@ -6,7 +6,7 @@ | ||
6 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> | 6 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> |
7 | <div class='profile-wall-actions'> | 7 | <div class='profile-wall-actions'> |
8 | <%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %> | 8 | <%= link_to s_('profile|Comment'), '#', { :class => 'focus-on-comment'} %> |
9 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json, _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> | 9 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), j(_('Are you sure you want to remove this activity and all its replies?').to_json)]) if logged_in? && current_person == @profile %> |
10 | </div> | 10 | </div> |
11 | </div> | 11 | </div> |
12 | 12 |
app/views/profile/_leave_scrap.html.erb
@@ -5,7 +5,7 @@ | @@ -5,7 +5,7 @@ | ||
5 | <p class='profile-activity-text'><%= link_to activity.user.name, activity.user.url %> <%= describe activity %></p> | 5 | <p class='profile-activity-text'><%= link_to activity.user.name, activity.user.url %> <%= describe activity %></p> |
6 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> | 6 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> |
7 | <div class='profile-wall-actions'> | 7 | <div class='profile-wall-actions'> |
8 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json, _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> | 8 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> |
9 | </div> | 9 | </div> |
10 | </div> | 10 | </div> |
11 | 11 |
app/views/profile/_profile_scrap.html.erb
@@ -12,7 +12,7 @@ | @@ -12,7 +12,7 @@ | ||
12 | <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %> | 12 | <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %> |
13 | </span> | 13 | </span> |
14 | <% end %> | 14 | <% end %> |
15 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json, _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %> | 15 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json), _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %> |
16 | </div> | 16 | </div> |
17 | </div> | 17 | </div> |
18 | 18 |
app/views/profile/_profile_scraps.html.erb
@@ -12,7 +12,7 @@ | @@ -12,7 +12,7 @@ | ||
12 | <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %> | 12 | <%= link_to_function s_('profile|Comment'), "hide_and_show(['#profile-wall-message-response-#{scrap.id}'],['#profile-wall-reply-#{scrap.id}', '#profile-wall-reply-form-#{scrap.id}']);$('reply_content_#{scrap.id}').value='';$('reply_content_#{scrap.id}').focus();return false", :class => "profile-send-reply" %> |
13 | </span> | 13 | </span> |
14 | <% end %> | 14 | <% end %> |
15 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json, _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %> | 15 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_scrap, :scrap_id => scrap.id, :view => params[:view]).to_json), _('Are you sure you want to remove this scrap and all its replies?').to_json]) if logged_in? && user.can_control_scrap?(scrap) %> |
16 | </div> | 16 | </div> |
17 | </div> | 17 | </div> |
18 | 18 |
app/views/profile/_upload_image.html.erb
@@ -6,7 +6,7 @@ | @@ -6,7 +6,7 @@ | ||
6 | <p class='profile-activity-text'><%= link_to activity.user.name, activity.user.url %> <%= describe activity %></p> | 6 | <p class='profile-activity-text'><%= link_to activity.user.name, activity.user.url %> <%= describe activity %></p> |
7 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> | 7 | <p class='profile-activity-time'><%= time_ago_as_sentence(activity.created_at) %></p> |
8 | <div class='profile-wall-actions'> | 8 | <div class='profile-wall-actions'> |
9 | - <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json, _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> | 9 | + <%= link_to_function(_('Remove'), 'remove_item_wall(this, %s, %s, %s); return false ;' % ["'.profile-activity-item'", j(url_for(:profile => params[:profile], :action => :remove_activity, :activity_id => activity.id, :view => params[:view]).to_json), _('Are you sure you want to remove this activity and all its replies?').to_json]) if logged_in? && current_person == @profile %> |
10 | </div> | 10 | </div> |
11 | </div> | 11 | </div> |
12 | </div> | 12 | </div> |
app/views/profile/report_abuse.html.erb
@@ -24,7 +24,7 @@ | @@ -24,7 +24,7 @@ | ||
24 | $('#report-abuse-submit-button').css('cursor', 'progress'); | 24 | $('#report-abuse-submit-button').css('cursor', 'progress'); |
25 | $.ajax({ | 25 | $.ajax({ |
26 | type: 'POST', | 26 | type: 'POST', |
27 | - url: <%= url_for({:controller => 'profile', :action => 'register_report', :profile => profile.identifier}).to_json %>, | 27 | + url: <%= j(url_for({:controller => 'profile', :action => 'register_report', :profile => profile.identifier}).to_json) %>, |
28 | data: $(form).serialize(), | 28 | data: $(form).serialize(), |
29 | dataType: 'json', | 29 | dataType: 'json', |
30 | success: function(data, status, ajax){ | 30 | success: function(data, status, ajax){ |