actionpack 2.3.5 → 2.3.6

data/lib/action_view/helpers/form_options_helper.rb

@@ -296,7 +296,7 @@ module ActionView
           options << %(<option value="#{html_escape(value.to_s)}"#{selected_attribute}#{disabled_attribute}>#{html_escape(text.to_s)}</option>)
         end
 
-        options_for_select.join("\n").html_safe!
+        options_for_select.join("\n").html_safe
       end
 
       # Returns a string of option tags that have been compiled by iterating over the +collection+ and assigning the
@@ -572,10 +572,9 @@ module ActionView
           end
           if value.blank? && options[:prompt]
             prompt = options[:prompt].kind_of?(String) ? options[:prompt] : I18n.translate('support.select.prompt', :default => 'Please select')
-            "<option value=\"\">#{prompt}</option>\n" + option_tags
-          else
-            option_tags
+            option_tags = "<option value=\"\">#{prompt}</option>\n" + option_tags
           end
+          option_tags.html_safe
         end
     end
 

data/lib/action_view/helpers/form_tag_helper.rb

@@ -78,6 +78,9 @@ module ActionView
       #   #    <option>Paris</option><option>Rome</option></select>
       def select_tag(name, option_tags = nil, options = {})
         html_name = (options[:multiple] == true && !name.to_s.ends_with?("[]")) ? "#{name}[]" : name
+        if Array === option_tags
+          ActiveSupport::Deprecation.warn 'Passing an array of option_tags to select_tag implicitly joins them without marking them as HTML-safe. Pass option_tags.join.html_safe instead.', caller
+        end
         content_tag :select, option_tags, { "name" => html_name, "id" => sanitize_to_id(name) }.update(options.stringify_keys)
       end
 
@@ -262,7 +265,7 @@ module ActionView
         escape = options.key?("escape") ? options.delete("escape") : true
         content = html_escape(content) if escape
 
-        content_tag :textarea, content, { "name" => name, "id" => sanitize_to_id(name) }.update(options.stringify_keys)
+        content_tag :textarea, content.html_safe, { "name" => name, "id" => sanitize_to_id(name) }.update(options.stringify_keys)
       end
 
       # Creates a check box form input tag.
@@ -432,7 +435,7 @@ module ActionView
         concat(tag(:fieldset, options, true))
         concat(content_tag(:legend, legend)) unless legend.blank?
         concat(content)
-        concat("</fieldset>".html_safe!)
+        concat("</fieldset>")
       end
 
       private
@@ -459,14 +462,14 @@ module ActionView
 
         def form_tag_html(html_options)
           extra_tags = extra_tags_for_form(html_options)
-          (tag(:form, html_options, true) + extra_tags).html_safe!
+          (tag(:form, html_options, true) + extra_tags).html_safe
         end
 
         def form_tag_in_block(html_options, &block)
           content = capture(&block)
           concat(form_tag_html(html_options))
           concat(content)
-          concat("</form>".html_safe!)
+          concat("</form>")
         end
 
         def token_tag

data/lib/action_view/helpers/javascript_helper.rb

@@ -184,7 +184,7 @@ module ActionView
       end
 
       def javascript_cdata_section(content) #:nodoc:
-        "\n//#{cdata_section("\n#{content}\n//")}\n"
+        "\n//#{cdata_section("\n#{content}\n//")}\n".html_safe
       end
 
     protected

data/lib/action_view/helpers/number_helper.rb

@@ -89,7 +89,7 @@ module ActionView
             :precision => precision,
             :delimiter => delimiter,
             :separator => separator)
-          ).gsub(/%u/, unit)
+          ).gsub(/%u/, unit).html_safe
         rescue
           number
         end

data/lib/action_view/helpers/prototype_helper.rb

@@ -393,7 +393,7 @@ module ActionView
 
         concat(form_remote_tag(options))
         fields_for(object_name, *(args << options), &proc)
-        concat('</form>'.html_safe!)
+        concat('</form>')
       end
       alias_method :form_remote_for, :remote_form_for
 
@@ -1026,7 +1026,7 @@ module ActionView
       #     page.hide 'spinner'
       #   end
       def update_page(&block)
-        JavaScriptGenerator.new(@template, &block).to_s
+        JavaScriptGenerator.new(@template, &block).to_s.html_safe
       end
 
       # Works like update_page but wraps the generated JavaScript in a <script>

data/lib/action_view/helpers/raw_output_helper.rb

@@ -2,8 +2,8 @@ module ActionView #:nodoc:
   module Helpers #:nodoc:
     module RawOutputHelper
       def raw(stringish)
-        stringish.to_s.html_safe!
+        stringish.to_s.html_safe
       end
     end
   end
-end
+end

data/lib/action_view/helpers/sanitize_helper.rb

@@ -49,11 +49,7 @@ module ActionView
       # confuse browsers.
       #
       def sanitize(html, options = {})
-        returning self.class.white_list_sanitizer.sanitize(html, options) do |sanitized|
-          if sanitized
-            sanitized.html_safe!
-          end
-        end
+        self.class.white_list_sanitizer.sanitize(html, options).try(:html_safe)
       end
 
       # Sanitizes a block of CSS code. Used by +sanitize+ when it comes across a style attribute.
@@ -76,11 +72,7 @@ module ActionView
       #   strip_tags("<div id='top-bar'>Welcome to my website!</div>")
       #   # => Welcome to my website!
       def strip_tags(html)
-        returning self.class.full_sanitizer.sanitize(html) do |sanitized|
-          if sanitized
-            sanitized.html_safe!
-          end
-        end
+        self.class.full_sanitizer.sanitize(html).try(:html_safe)
       end
 
       # Strips all link tags from +text+ leaving just the link text.

data/lib/action_view/helpers/tag_helper.rb

@@ -1,4 +1,5 @@
-require 'action_view/erb/util'
+require 'active_support/multibyte'
+require 'active_support/core_ext/string/output_safety'
 require 'set'
 
 module ActionView
@@ -38,7 +39,7 @@ module ActionView
       #   tag("img", { :src => "open & shut.png" }, false, false)
       #   # => <img src="open &amp; shut.png" />
       def tag(name, options = nil, open = false, escape = true)
-        "<#{name}#{tag_options(options, escape) if options}#{open ? ">" : " />"}".html_safe!
+        "<#{name}#{tag_options(options, escape) if options}#{open ? ">" : " />"}".html_safe
       end
 
       # Returns an HTML block tag of type +name+ surrounding the +content+. Add
@@ -91,7 +92,7 @@ module ActionView
       #   cdata_section(File.read("hello_world.txt"))
       #   # => <![CDATA[<hello from a text file]]>
       def cdata_section(content)
-        "<![CDATA[#{content}]]>".html_safe!
+        "<![CDATA[#{content}]]>".html_safe
       end
 
       # Returns an escaped version of +html+ without affecting existing escaped entities.
@@ -125,7 +126,7 @@ module ActionView
 
         def content_tag_string(name, content, options, escape = true)
           tag_options = tag_options(options, escape) if options
-          "<#{name}#{tag_options}>#{content}</#{name}>".html_safe!
+          "<#{name}#{tag_options}>#{content}</#{name}>".html_safe
         end
 
         def tag_options(options, escape = true)
@@ -142,7 +143,7 @@ module ActionView
             else
               attrs = options.map { |key, value| %(#{key}="#{value}") }
             end
-            " #{attrs.sort * ' '}".html_safe! unless attrs.empty?
+            " #{attrs.sort * ' '}".html_safe unless attrs.empty?
           end
         end
     end

data/lib/action_view/helpers/text_helper.rb

@@ -29,7 +29,7 @@ module ActionView
           ActiveSupport::Deprecation.warn("The binding argument of #concat is no longer needed.  Please remove it from your views and helpers.", caller)
         end
 
-        output_buffer << string
+        output_buffer.safe_concat(string)
       end
 
       # Truncates a given +text+ after a given <tt>:length</tt> if +text+ is longer than <tt>:length</tt>
@@ -181,7 +181,7 @@ module ActionView
       #   pluralize(0, 'person')
       #   # => 0 people
       def pluralize(count, singular, plural = nil)
-        "#{count || 0} " + ((count == 1 || count == '1') ? singular : (plural || singular.pluralize))
+        "#{count || 0} " + ((count == 1 || count =~ /^1(\.0+)?$/) ? singular : (plural || singular.pluralize))
       end
 
       # Wraps the +text+ into lines no longer than +line_width+ width. This method
@@ -328,7 +328,7 @@ module ActionView
         text.gsub!(/\n\n+/, "</p>\n\n#{start_tag}")  # 2+ newline  -> paragraph
         text.gsub!(/([^\n]\n)(?=[^\n])/, '\1<br />') # 1 newline   -> br
         text.insert 0, start_tag
-        text << "</p>"
+        text.html_safe.safe_concat("</p>")
       end
 
       # Turns all URLs and e-mail addresses into clickable links. The <tt>:link</tt> option
@@ -548,7 +548,7 @@ module ActionView
             left, right = $`, $'
             # detect already linked URLs and URLs in the middle of a tag
             if left =~ /<[^>]+$/ && right =~ /^[^>]*>/
-              # do not change string; URL is alreay linked
+              # do not change string; URL is already linked
               href
             else
               # don't include trailing punctuation character as part of the URL
@@ -560,7 +560,7 @@ module ActionView
               end
 
               link_text = block_given?? yield(href) : href
-              href = 'http://' + href unless href.index('http') == 0
+              href = 'http://' + href unless href =~ %r{^[a-z]+://}i
 
               content_tag(:a, h(link_text), link_attributes.merge('href' => href)) + punctuation
             end

data/lib/action_view/helpers/translation_helper.rb

@@ -12,7 +12,8 @@ module ActionView
       # prepend the key with a period, nothing is converted.
       def translate(key, options = {})
         options[:raise] = true
-        I18n.translate(scope_key_by_partial(key), options)
+        translation = I18n.translate(scope_key_by_partial(key), options)
+        (translation.respond_to?(:join) ? translation.join : translation).html_safe
       rescue I18n::MissingTranslationData => e
         keys = I18n.send(:normalize_translation_keys, e.locale, e.key, e.options[:scope])
         content_tag('span', keys.join(', '), :class => 'translation_missing')
@@ -28,12 +29,13 @@ module ActionView
 
       private
         def scope_key_by_partial(key)
-          if key.to_s.first == "."
-            template.path_without_format_and_extension.gsub(%r{/_?}, ".") + key.to_s
+          strkey = key.respond_to?(:join) ? key.join : key.to_s
+          if strkey.first == "."
+            template.path_without_format_and_extension.gsub(%r{/_?}, ".") + strkey
           else
             key
           end
         end
     end
   end
-end
+end

data/lib/action_view/helpers/url_helper.rb

@@ -91,7 +91,7 @@ module ActionView
           polymorphic_path(options)
         end
 
-        escape ? escape_once(url) : url
+        escape ? escape_once(url).html_safe : url
       end
 
       # Creates a link tag of the given +name+ using a URL created by the set
@@ -219,7 +219,7 @@ module ActionView
         if block_given?
           options      = args.first || {}
           html_options = args.second
-          concat(link_to(capture(&block), options, html_options).html_safe!)
+          concat(link_to(capture(&block), options, html_options))
         else
           name         = args.first
           options      = args.second || {}
@@ -237,7 +237,7 @@ module ActionView
           end
 
           href_attr = "href=\"#{url}\"" unless href
-          "<a #{href_attr}#{tag_options}>#{name || url}</a>".html_safe!
+          "<a #{href_attr}#{tag_options}>#{name || url}</a>".html_safe
         end
       end
 
@@ -308,8 +308,8 @@ module ActionView
 
         html_options.merge!("type" => "submit", "value" => name)
 
-        "<form method=\"#{form_method}\" action=\"#{escape_once url}\" class=\"button-to\"><div>" +
-          method_tag + tag("input", html_options) + request_token_tag + "</div></form>".html_safe!
+        ("<form method=\"#{form_method}\" action=\"#{escape_once url}\" class=\"button-to\"><div>" +
+          method_tag + tag("input", html_options) + request_token_tag + "</div></form>").html_safe
       end
 
 
@@ -466,14 +466,12 @@ module ActionView
         extras << "subject=#{CGI.escape(subject).gsub("+", "%20")}&" unless subject.nil?
         extras = "?" << extras.gsub!(/&?$/,"") unless extras.empty?
 
-        email_address = email_address.to_s
-
-        email_address_obfuscated = email_address.dup
+        email_address_obfuscated = html_escape(email_address)
         email_address_obfuscated.gsub!(/@/, html_options.delete("replace_at")) if html_options.has_key?("replace_at")
         email_address_obfuscated.gsub!(/\./, html_options.delete("replace_dot")) if html_options.has_key?("replace_dot")
 
         if encode == "javascript"
-          "document.write('#{content_tag("a", name || email_address_obfuscated, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c|
+          "document.write('#{content_tag("a", name || email_address_obfuscated.html_safe, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c|
             string << sprintf("%%%x", c)
           end
           "<script type=\"#{Mime::JS}\">eval(decodeURIComponent('#{string}'))</script>"
@@ -490,9 +488,9 @@ module ActionView
             char = c.chr
             string << (char =~ /\w/ ? sprintf("%%%x", c) : char)
           end
-          content_tag "a", name || email_address_encoded, html_options.merge({ "href" => "#{string}#{extras}" })
+          content_tag "a", name || email_address_encoded.html_safe, html_options.merge({ "href" => "#{string}#{extras}" })
         else
-          content_tag "a", name || email_address_obfuscated, html_options.merge({ "href" => "mailto:#{email_address}#{extras}" })
+          content_tag "a", name || email_address_obfuscated.html_safe, html_options.merge({ "href" => "mailto:#{email_address}#{extras}" })
         end
       end
 

data/lib/action_view/partials.rb

@@ -218,10 +218,11 @@ module ActionView
             ActionController::RecordIdentifier.partial_path(object, controller.class.controller_path)
           template = _pick_partial_template(_partial_path)
           local_assigns[template.counter_name] = index
+          local_assigns["#{as.to_s}_counter".to_sym] = local_assigns[template.counter_name] if as
           result = template.render_partial(self, object, local_assigns.dup, as)
           index += 1
           result
-        end.join(spacer).html_safe!
+        end.join(spacer).html_safe
       end
 
       def _pick_partial_template(partial_path) #:nodoc:

data/lib/action_view/paths.rb

@@ -47,15 +47,23 @@ module ActionView #:nodoc:
       each do |load_path|
         if format && (template = load_path["#{template_path}.#{I18n.locale}.#{format}"])
           return template
+        # Try the default locale version if the current locale doesn't have one
+        # (i.e. you haven't translated this view to German yet, but you have the English version on hand)
+        elsif format && (template = load_path["#{template_path}.#{I18n.default_locale}.#{format}"]) 
+          return template
         elsif format && (template = load_path["#{template_path}.#{format}"])
           return template
         elsif template = load_path["#{template_path}.#{I18n.locale}"]
           return template
+        elsif template = load_path["#{template_path}.#{I18n.default_locale}"]
+          return template
         elsif template = load_path[template_path]
           return template
         # Try to find html version if the format is javascript
         elsif format == :js && html_fallback && template = load_path["#{template_path}.#{I18n.locale}.html"]
           return template
+        elsif format == :js && html_fallback && template = load_path["#{template_path}.#{I18n.default_locale}.html"]
+          return template
         elsif format == :js && html_fallback && template = load_path["#{template_path}.html"]
           return template
         end

data/lib/action_view/renderable.rb

@@ -65,16 +65,30 @@ module ActionView
       def compile!(render_symbol, local_assigns)
         locals_code = local_assigns.keys.map { |key| "#{key} = local_assigns[:#{key}];" }.join
 
+        code = compiled_source
+        if code.sub!(/\A(#.*coding.*)\n/, '')
+          encoding_comment = $1
+        elsif defined?(Encoding) && Encoding.respond_to?(:default_external)
+          encoding_comment = "#coding:#{Encoding.default_external}"
+        end
+
         source = <<-end_src
           def #{render_symbol}(local_assigns)
-            old_output_buffer = output_buffer;#{locals_code};#{compiled_source}
+            old_output_buffer = output_buffer;#{locals_code};#{code}
           ensure
             self.output_buffer = old_output_buffer
           end
         end_src
 
+        if encoding_comment
+          source = "#{encoding_comment}\n#{source}"
+          line = -1
+        else
+          line = 0
+        end
+
         begin
-          ActionView::Base::CompiledTemplates.module_eval(source, filename, 0)
+          ActionView::Base::CompiledTemplates.module_eval(source, filename, line)
         rescue Errno::ENOENT => e
           raise e # Missing template file, re-raise for Base to rescue
         rescue Exception => e # errors from template code

data/lib/action_view/template_handlers/erb.rb

@@ -11,11 +11,9 @@ module ActionView
       self.erb_trim_mode = '-'
 
       def compile(template)
-        src = ::ERB.new("<% __in_erb_template=true %>#{template.source}", nil, erb_trim_mode, '@output_buffer').src
-
-        # Ruby 1.9 prepends an encoding to the source. However this is
-        # useless because you can only set an encoding on the first line
-        RUBY_VERSION >= '1.9' ? src.sub(/\A#coding:.*\n/, '') : src
+        magic = $1 if template.source =~ /\A(<%#.*coding[:=]\s*(\S+)\s*-?%>)/
+        erb = "#{magic}<% __in_erb_template=true %>#{template.source}"
+        ::ERB.new(erb, nil, erb_trim_mode, '@output_buffer').src
       end
     end
   end

data/lib/action_view/test_case.rb

@@ -53,7 +53,7 @@ module ActionView
     setup :setup_with_controller
     def setup_with_controller
       @controller = TestController.new
-      @output_buffer = ''
+      @output_buffer = ActiveSupport::SafeBuffer.new
       @rendered = ''
 
       self.class.send(:include_helper_modules!)
@@ -159,4 +159,4 @@ module ActionView
         end
       end
   end
-end
+end

data/test/abstract_unit.rb

@@ -32,9 +32,9 @@ ActionController::Routing::Routes.reload rescue nil
 
 ActionController::Base.session_store = nil
 
-# Register danish language for testing
-I18n.backend.store_translations 'da', {}
-I18n.backend.store_translations 'pt-BR', {}
+# Register languages for testing
+I18n.backend.store_translations 'da', "da" => {}
+I18n.backend.store_translations 'pt-BR', "pt-BR" => {}
 ORIGINAL_LOCALES = I18n.available_locales.map(&:to_s).sort
 
 FIXTURE_LOAD_PATH = File.join(File.dirname(__FILE__), 'fixtures')

data/test/controller/action_pack_assertions_test.rb

@@ -458,7 +458,9 @@ class ActionPackAssertionsControllerTest < ActionController::TestCase
 
   def test_redirected_to_url_no_leadling_slash
     process :redirect_to_path
-    assert_redirected_to 'some/path'
+    assert_deprecated /leading/ do
+      assert_redirected_to 'some/path'
+    end
   end
 
   def test_redirected_to_url_full_url