formtastic-rails3 0.9.10.1 → 1.0.0.beta3

data/README.textile

@@ -77,20 +77,33 @@ h2. Documentation
 RDoc documentation _should_ be automatically generated after each commit and made available on the "rdoc.info website":http://rdoc.info/projects/justinfrench/formtastic.
 
 
-h2. Installation
+h2. A Note About Rails 3 Support
 
-The gem is hosted on gemcutter, so *if you haven't already*, add it as a gem source:
+Formtastic 1.0 will only support the latest stable Rails 2.x. We're maintaining a rails3 branch which aims to provide both Rails 2.x and 3.x support, which is targeted for the 1.1 release soon after 1.0, around the same time Rails 3.0 ships.
+
+If you have a Rails 3 project and would like to use Formtastic's rails3 branch, bundler provides you with the ability to do this easily. Just add Formtastic as a git dependency in your Gemfile with the :branch option:
 
 <pre>
-  sudo gem sources -a http://gemcutter.org/
+  gem 'formtastic', :git => "http://github.com/justinfrench/formtastic.git", :branch => "rails3"
 </pre>
 
-Then install the Formtastic gem:
+Please be aware that Rails 3 is still under heavy development (even in the later betas), as is Formtastic, so our rails3 branch is very much "on the edge", just like Rails. if you find issues, compatibility issues with Rails 2 or 3, please report an issue on Github.
+
+
+h2. Installation under Rails 2.x
+
+Install the Formtastic gem:
 
 <pre>
   sudo gem install formtastic
 </pre>
 
+Or try the 1.0.0.beta2:
+
+<pre>
+  sudo gem install formtastic --pre
+</pre>
+
 And add it to your environment.rb configuration as a gem dependency:
 
 <pre>
@@ -113,6 +126,7 @@ A proof-of-concept stylesheet is provided which you can include in your layout.
   </head>
 </pre>
 
+
 h2. Usage
 
 Forms are really boring to code... you want to get onto the good stuff as fast as possible.
@@ -517,12 +531,18 @@ If you want to add your own input types to encapsulate your own logic or interfa
 
 @Formtastic::SemanticFormHelper.builder = MyCustomBuilder@
 
+h2. Security
+
+By default formtastic escapes html entities in both labels and hints unless a string is marked as html_safe. If you are using an older rails version which doesn't know html_safe, or you want to globally turn this feature off, you can set the following in your initializer:
 
+Formtastic::SemanticFormBuilder.escape_html_entities_in_hints_and_labels = false
 
 
-h2. Status
+h2. Focus
 
-Formtastic has been in active development for about a year. We've just recently jumped to an 0.9 version number, signaling that we consider this a 1.0 release candidate, and that the API won't change significantly for the 1.x series.
+Formtastic is close to shipping a 1.0 release candidate after more than a year of active development. 1.0 will be compatible with Rails 2, and this is our top priority right now. We've also been working hard on a Rails 2 *and* 3 compatible version in the rails3 branch, targeting a 1.1 release shortly after Rails 3.0 ships.
+
+There's heaps more we want to do, but we have to do this first.
 
 
 h2. Dependencies
@@ -536,18 +556,14 @@ There are none, but...
 
 h2. Compatibility
 
-I'm only testing Formtastic with the latest Rails 2.4.x stable release, and it should be fine under Rails 2.3.x as well (including nested forms). Patches are welcome to allow backwards compatibility, but I don't have the energy!
-
-h2. Got TextMate?
-
-Well...there's a TextMate-bundle in town, dedicated to make usage of Formtastic in the "TextMate":http://macromates.com/ editor even more of a breeze:
-
-"Formtastic.tmbundle":http://github.com/grimen/formtastic_tmbundle
-
+* We're only testing Formtastic with the latest Rails 2.x stable release. Patches are welcome to allow backwards compatibility with older versions of Rails, of course.
+* Development of a Rails 2 *and* 3 compatible version of Formtastic is underway in the rails3 branch, targeting a Formtastic 1.1 release shortly after Rails 3.0 ships.
+* Formtastic, much like Rails 2, is very ActiveRecord-centric. Many people are using Formtastic (especially the rails3 branch) successfully with other ActiveModel-like ORMs and classes (DataMapper, MongoMapper, Mongoid, Authlogic, Devise...) but we're not guaranteeing anything at this stage. Patches are welcome, but it's not our core focus right now. Shipping a solid 1.0 and Rails 3 compatible 1.1 is. 
+ 
 
 h2. How to contribute
 
-*Before you send a pull request*, please ensure that you provide appropriate spec/test coverage and ensure the documentation is up-to-date.  Bonus points if you perform your changes in a clean topic branch rather than master.
+Please ensure that you provide appropriate spec/test coverage and ensure the documentation is up-to-date.  Bonus points if you perform your changes in a clean topic branch rather than master, and if you create an issue on GH for us to discuss your changes. Pull requests tend to get lost.
 
 Please also keep your commits *atomic* so that they are more likely to apply cleanly.  That means that each commit should contain the smallest possible logical change.  Don't commit two features at once, don't update the gemspec at the same time you add a feature, don't fix a whole bunch of whitespace in a file at the same time you change a few lines, etc, etc.
 
@@ -556,7 +572,7 @@ For significant changes, you may wish to discuss your idea on the Formtastic Goo
 
 h2. Maintainers & Contributors
 
-Formtastic is maintained by "Justin French":http://justinfrench.com, "José Valim":http://github.com/josevalim and "Jonas Grimfelt":http://github.com/grimen, but it wouldn't be as awesome as it is today without help from over 40 contributors.
+Formtastic is maintained by "Justin French":http://github.com/justinfrench, "Morton Jonuschat":http://github.com/yabawock and "Gabriel Sobrinho":http://github.com/sobrinho. "Denis Major":http://github.com/denismajor1 is doing some amazing documentation work in the wiki, and we very much appreciate the past efforts of "José Valim":http://github.com/josevalim and "Jonas Grimfelt":http://github.com/grimen and over 40 other contributors.
 
 @git shortlog -n -s --no-merges@
 

data/Rakefile

@@ -37,14 +37,14 @@ begin
   Find out more and get involved:
     http://github.com/justinfrench/formtastic
     http://groups.google.com.au/group/formtastic
-    
+
   All credit goes to the original author, Justin French.
   ========================================================================
   }
-  
+
   gem 'jeweler', '>= 1.0.0'
   require 'jeweler'
-  
+
   Jeweler::Tasks.new do |s|
     s.name = GEM
     s.summary = SUMMARY
@@ -53,21 +53,21 @@ begin
     s.description = SUMMARY
     s.author = AUTHOR
     s.post_install_message = INSTALL_MESSAGE
-    
+
     s.require_path = 'lib'
     s.files = %w(MIT-LICENSE README.textile Rakefile) + Dir.glob("{rails,lib,generators,spec}/**/*")
-    
+
     # Runtime dependencies: When installing Formtastic these will be checked if they are installed.
     # Will be offered to install these if they are not already installed.
     s.add_dependency 'activesupport', '>= 3.0.0beta3'
     s.add_dependency 'actionpack', '>= 3.0.0beta3'
-    
+
     # Development dependencies. Not installed by default.
     # Install with: sudo gem install formtastic --development
     s.add_development_dependency 'rspec-rails', '>= 1.2.6'
     s.add_development_dependency 'rspec_tag_matchers', '>= 1.0.0'
   end
-  
+
   Jeweler::GemcutterTasks.new
 rescue LoadError
   puts "[formtastic:] Jeweler - or one of its dependencies - is not available. Install it with: sudo gem install jeweler -s http://gemcutter.org"
@@ -106,19 +106,19 @@ if defined?(Spec)
   end
 end
 
-if defined?(Rspec)
+if defined?(RSpec)
   desc 'Test the formtastic plugin.'
-  Rspec::Core::RakeTask.new('spec') do |t|
+  RSpec::Core::RakeTask.new('spec') do |t|
     t.pattern = FileList['spec/**/*_spec.rb']
   end
 
   desc 'Test the formtastic plugin with specdoc formatting and colors'
-  Rspec::Core::RakeTask.new('specdoc') do |t|
+  RSpec::Core::RakeTask.new('specdoc') do |t|
     t.pattern = FileList['spec/**/*_spec.rb']
   end
 
   desc "Run all examples with RCov"
-  Rspec::Core::RakeTask.new('examples_with_rcov') do |t|
+  RSpec::Core::RakeTask.new('examples_with_rcov') do |t|
     t.pattern = FileList['spec/**/*_spec.rb']
     t.rcov = true
     t.rcov_opts = ['--exclude', 'spec,Library']

data/lib/formtastic.rb

@@ -20,11 +20,12 @@ module Formtastic #:nodoc:
     @@file_methods = [ :file?, :public_filename, :filename ]
     @@priority_countries = ["Australia", "Canada", "United Kingdom", "United States"]
     @@i18n_lookups_by_default = false
+    @@escape_html_entities_in_hints_and_labels = true
     @@default_commit_button_accesskey = nil 
 
     cattr_accessor :default_text_field_size, :default_text_area_height, :all_fields_required_by_default, :include_blank_for_select_by_default,
                    :required_string, :optional_string, :inline_errors, :label_str_method, :collection_label_methods,
-                   :inline_order, :file_methods, :priority_countries, :i18n_lookups_by_default, :default_commit_button_accesskey 
+                   :inline_order, :file_methods, :priority_countries, :i18n_lookups_by_default, :escape_html_entities_in_hints_and_labels, :default_commit_button_accesskey 
 
     RESERVED_COLUMNS = [:created_at, :updated_at, :created_on, :updated_on, :lock_version, :version]
 
@@ -483,7 +484,7 @@ module Formtastic #:nodoc:
       # Collects association columns (relation columns) for the current form object class.
       #
       def association_columns(*by_associations) #:nodoc:
-        if @object.present?
+        if @object.present? && @object.class.respond_to?(:reflections)
           @object.class.reflections.collect do |name, _|
             if by_associations.present?
               name if by_associations.include?(_.macro)
@@ -528,9 +529,17 @@ module Formtastic #:nodoc:
           raise ArgumentError, 'You gave :for option with a block to inputs method, ' <<
                                'but the block does not accept any argument.' if block.arity <= 0
 
-          proc { |f| return f.inputs(*args){ block.call(f) } }
+          lambda do |f|
+            contents = f.inputs(*args){ block.call(f) }
+            template.concat(contents) if ::Formtastic::Util.rails3?
+            contents
+          end
         else
-          proc { |f| return f.inputs(*args) }
+          lambda do |f|
+            contents = f.inputs(*args)
+            template.concat(contents) if ::Formtastic::Util.rails3?
+            contents
+          end
         end
 
         fields_for_args = [options.delete(:for), options.delete(:for_options) || {}].flatten
@@ -541,7 +550,7 @@ module Formtastic #:nodoc:
       #
       def strip_formtastic_options(options) #:nodoc:
         options.except(:value_method, :label_method, :collection, :required, :label,
-                       :as, :hint, :input_html, :label_html, :value_as_class)
+                       :as, :hint, :input_html, :label_html, :value_as_class, :find_options)
       end
 
       # Determins if the attribute (eg :title) should be considered required or not.
@@ -889,15 +898,20 @@ module Formtastic #:nodoc:
           html_options[:checked] = selected_value == value if selected_option_is_present
 
           li_content = template.content_tag(:label,
-            Formtastic::Util.html_safe("#{self.radio_button(input_name, value, html_options)} #{label}"),
+            Formtastic::Util.html_safe("#{self.radio_button(input_name, value, html_options)} #{escape_html_entities(label)}"),
             :for => input_id
           )
 
           li_options = value_as_class ? { :class => [method.to_s.singularize, value.to_s.downcase].join('_') } : {}
           template.content_tag(:li, Formtastic::Util.html_safe(li_content), li_options)
         end
-
-        field_set_and_list_wrapping_for_method(method, options, list_item_content)
+        
+        template.content_tag(:fieldset,
+          template.content_tag(:legend, 
+            template.label_tag(nil, localized_string(method, options[:label], :label) || humanized_attribute_name(method), :for => nil), :class => :label
+          ) << 
+          template.content_tag(:ol, Formtastic::Util.html_safe(list_item_content.join))
+        )
       end
       alias :boolean_radio_input :radio_input
 
@@ -1016,6 +1030,7 @@ module Formtastic #:nodoc:
         i18n_date_order = ::I18n.t(:order, :scope => [:date])
         i18n_date_order = nil unless i18n_date_order.is_a?(Array)
         inputs   = options.delete(:order) || i18n_date_order || [:year, :month, :day]
+        inputs   = [] if options[:ignore_date]
         labels   = options.delete(:labels) || {}
 
         time_inputs = [:hour, :minute]
@@ -1123,6 +1138,15 @@ module Formtastic #:nodoc:
       #   f.input :authors, :as => :check_boxes, :selected => Author.most_popular.collect(&:id)
       #   f.input :authors, :as => :check_boxes, :selected => nil   # override any defaults: select none
       #
+      #
+      # Formtastic works around a bug in rails handling of check box collections by
+      # not generating the hidden fields for state checking of the checkboxes 
+      # The :hidden_fields option provides a way to re-enable these hidden inputs by
+      # setting it to true.
+      #
+      #   f.input :authors, :as => :check_boxes, hidden_fields => false
+      #   f.input :authors, :as => :check_boxes, hidden_fields => true
+      #
       # Finally, you can set :value_as_class => true if you want the li wrapper around each checkbox / label 
       # combination to contain a class with the value of the radio button (useful for applying specific 
       # CSS or Javascript to a particular checkbox).
@@ -1132,15 +1156,13 @@ module Formtastic #:nodoc:
         html_options = options.delete(:input_html) || {}
 
         input_name      = generate_association_input_name(method)
+        hidden_fields   = options.delete(:hidden_fields)
         value_as_class  = options.delete(:value_as_class)
         unchecked_value = options.delete(:unchecked_value) || ''
         html_options    = { :name => "#{@object_name}[#{input_name}][]" }.merge(html_options)
         input_ids       = []
 
-        selected_option_is_present = [:selected, :checked].any? { |k| options.key?(k) }
-        selected_values = (options.key?(:checked) ? options[:checked] : options[:selected]) if selected_option_is_present
-        selected_values  = [*selected_values].compact
-
+        selected_values = find_selected_values_for_column(method, options)
         disabled_option_is_present = options.key?(:disabled)
         disabled_values = [*options[:disabled]] if disabled_option_is_present
 
@@ -1150,12 +1172,12 @@ module Formtastic #:nodoc:
           input_id = generate_html_id(input_name, value.to_s.gsub(/\s/, '_').gsub(/\W/, '').downcase)
           input_ids << input_id
 
-          html_options[:checked] = selected_values.include?(value) if selected_option_is_present
+          html_options[:checked] = selected_values.include?(value)
           html_options[:disabled] = disabled_values.include?(value) if disabled_option_is_present
           html_options[:id] = input_id
 
           li_content = template.content_tag(:label,
-            Formtastic::Util.html_safe("#{self.check_box(input_name, html_options, value, unchecked_value)} #{label}"),
+            Formtastic::Util.html_safe("#{self.create_check_boxes(input_name, html_options, value, unchecked_value, hidden_fields)} #{escape_html_entities(label)}"),
             :for => input_id
           )
 
@@ -1163,7 +1185,40 @@ module Formtastic #:nodoc:
           template.content_tag(:li, Formtastic::Util.html_safe(li_content), li_options)
         end
 
-        field_set_and_list_wrapping_for_method(method, options, list_item_content)
+        template.content_tag(:fieldset,
+          template.content_tag(:legend, 
+            template.label_tag(nil, localized_string(method, options[:label], :label) || humanized_attribute_name(method), :for => nil), :class => :label
+          ) << 
+          template.content_tag(:ol, Formtastic::Util.html_safe(list_item_content.join))
+        )
+      end
+
+      # Used by check_boxes input. The selected values will be set either by:
+      #
+      # * Explicitly provided through :selected or :checked
+      # * Values retrieved through an association
+      #
+      # If the collection is not a hash or an array of strings, fixnums or symbols,
+      # we use value_method to retrieve an array with the values
+      #
+      def find_selected_values_for_column(method, options)
+        selected_option_is_present = [:selected, :checked].any? { |k| options.key?(k) }
+        if selected_option_is_present
+          selected_values = (options.key?(:checked) ? options[:checked] : options[:selected])
+        elsif object.respond_to?(method)
+          collection = [object.send(method)].compact.flatten
+          label, value = detect_label_and_value_method!(collection, options)
+          selected_values = collection.map { |o| send_or_call(value, o) }
+        end
+        selected_values = [*selected_values].compact
+        selected_values
+      end
+      
+      # Outputs a checkbox tag. If called with no_hidden_input = true a plain check_box_tag is returned,
+      # otherwise the helper uses the output generated by the rails check_box method.
+      def create_check_boxes(input_name, html_options = {}, checked_value = "1", unchecked_value = "0", hidden_fields = false)
+        return template.check_box_tag(input_name, checked_value, html_options[:checked], html_options) unless hidden_fields == true
+        self.check_box(input_name, html_options, checked_value, unchecked_value)
       end
 
       # Outputs a country select input, wrapping around a regular country_select helper. 
@@ -1224,7 +1279,7 @@ module Formtastic #:nodoc:
       #
       def inline_hints_for(method, options) #:nodoc:
         options[:hint] = localized_string(method, options[:hint], :hint)
-        return if options[:hint].blank?
+        return if options[:hint].blank? or options[:hint].kind_of? Hash
         template.content_tag(:p, Formtastic::Util.html_safe(options[:hint]), :class => 'inline-hints')
       end
 
@@ -1311,7 +1366,7 @@ module Formtastic #:nodoc:
           html_options.except(:builder, :parent)
         )
 
-        template.concat(fieldset) if block_given? && (!defined?(Rails::VERSION) || Rails::VERSION::MAJOR == 2)
+        template.concat(fieldset) if block_given? && !Formtastic::Util.rails3?
         fieldset
       end
 
@@ -1402,7 +1457,8 @@ module Formtastic #:nodoc:
 
         # Return if we have an Array of strings, fixnums or arrays
         return collection if (collection.instance_of?(Array) || collection.instance_of?(Range)) &&
-                             [Array, Fixnum, String, Symbol].include?(collection.first.class)
+                             [Array, Fixnum, String, Symbol].include?(collection.first.class) &&
+                             !(options.include?(:label_method) || options.include?(:value_method))
 
         label, value = detect_label_and_value_method!(collection, options)
         collection.map { |o| [send_or_call(label, o), send_or_call(value, o)] }
@@ -1419,7 +1475,6 @@ module Formtastic #:nodoc:
           if conditions = reflection.options[:conditions]
             options[:find_options][:conditions] = reflection.klass.merge_conditions(conditions, options[:find_options][:conditions])
           end
-
           reflection.klass.find(:all, options[:find_options])
         else
           create_boolean_collection(options)
@@ -1542,7 +1597,8 @@ module Formtastic #:nodoc:
         elsif type == :numeric || column.nil? || column.limit.nil?
           { :size => @@default_text_field_size }
         else
-          { :maxlength => column.limit, :size => [column.limit, @@default_text_field_size].min }
+          { :maxlength => column.limit, 
+            :size => @@default_text_field_size && [column.limit, @@default_text_field_size].min }
         end
       end
 
@@ -1622,7 +1678,7 @@ module Formtastic #:nodoc:
         key = value if value.is_a?(::Symbol)
 
         if value.is_a?(::String)
-          value
+          escape_html_entities(value)
         else
           use_i18n = value.nil? ? @@i18n_lookups_by_default : (value != false)
 
@@ -1644,6 +1700,7 @@ module Formtastic #:nodoc:
 
             i18n_value = ::Formtastic::I18n.t(defaults.shift,
               options.merge(:default => defaults, :scope => type.to_s.pluralize.to_sym))
+            i18n_value = escape_html_entities(i18n_value) if i18n_value.is_a?(::String)
             i18n_value.blank? ? nil : i18n_value
           end
         end
@@ -1676,6 +1733,14 @@ module Formtastic #:nodoc:
         options
       end
 
+      def escape_html_entities(string) #:nodoc:
+        if @@escape_html_entities_in_hints_and_labels
+          # Acceppt html_safe flag as indicator to skip escaping
+          string = template.escape_once(string) unless string.respond_to?(:html_safe?) && string.html_safe? == true
+        end
+        string
+      end
+
   end
 
   # Wrappers around form_for (etc) with :builder => SemanticFormBuilder.
@@ -1713,9 +1778,7 @@ module Formtastic #:nodoc:
   module SemanticFormHelper
     @@builder = ::Formtastic::SemanticFormBuilder
     mattr_accessor :builder
-    
-    @@default_field_error_proc = nil
-    
+        
     # Override the default ActiveRecordHelper behaviour of wrapping the input.
     # This gets taken care of semantically by adding an error class to the LI tag
     # containing the input.
@@ -1725,11 +1788,11 @@ module Formtastic #:nodoc:
     end
     
     def with_custom_field_error_proc(&block)
-      @@default_field_error_proc = ::ActionView::Base.field_error_proc
+      default_field_error_proc = ::ActionView::Base.field_error_proc
       ::ActionView::Base.field_error_proc = FIELD_ERROR_PROC
-      result = yield
-      ::ActionView::Base.field_error_proc = @@default_field_error_proc
-      result
+      yield
+    ensure
+      ::ActionView::Base.field_error_proc = default_field_error_proc
     end
     
     def semantic_remote_form_for_wrapper(record_or_name_or_array, *args, &proc)
@@ -1749,12 +1812,14 @@ module Formtastic #:nodoc:
           options[:builder] ||= @@builder
           options[:html] ||= {}
 
+          singularizer = defined?(ActiveModel::Naming.singular) ? ActiveModel::Naming.method(:singular) : ActionController::RecordIdentifier.method(:singular_class_name)
+
           class_names = options[:html][:class] ? options[:html][:class].split(" ") : []
           class_names << "formtastic"
           class_names << case record_or_name_or_array
             when String, Symbol then record_or_name_or_array.to_s               # :post => "post"
-            when Array then ActionController::RecordIdentifier.singular_class_name(record_or_name_or_array.last.class)  # [@post, @comment] # => "comment"
-            else ActionController::RecordIdentifier.singular_class_name(record_or_name_or_array.class)                  # @post => "post"
+            when Array then singularizer.call(record_or_name_or_array.last.class)  # [@post, @comment] # => "comment"
+            else singularizer.call(record_or_name_or_array.class)                  # @post => "post"
           end
           options[:html][:class] = class_names.join(" ")