Skip to content

Commit

Permalink
Don't double escape HTML in the admin user list
Browse files Browse the repository at this point in the history
  • Loading branch information
lizconlan committed Aug 16, 2018
1 parent 4410611 commit f5a4253
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 1 deletion.
2 changes: 1 addition & 1 deletion app/views/admin_user/_user_table.html.erb
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<span class="user-labels">
<%= user_labels(user) %>
</span>
<%= link_to("#{ h(user.name) }", admin_user_path(user)) %>
<%= link_to("#{ h(user.name.html_safe) }", admin_user_path(user)) %>
<%= link_to("(#{ h(user.email) })", "mailto:#{ h(user.email) }") %>
</span>
<span class="item-metadata">
Expand Down
21 changes: 21 additions & 0 deletions spec/views/admin_user/_user_table.html.erb_spec.rb
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
require 'spec_helper'

describe "admin_user/_user_table.html.erb" do
let(:admin_user) { FactoryBot.create(:admin_user) }
let(:users) do
user_array = [
FactoryBot.create(:user, name: "Samuel Beckett"),
FactoryBot.create(:user, name: "Fintan O'Toole")
]
allow(user_array).to receive(:total_pages).and_return(1)
user_array
end

it 'does not double escape apostrophes' do
allow(controller).to receive(:current_user).and_return(admin_user)
render partial: 'admin_user/user_table.html.erb',
locals: { users: users,
banned_column: false }
expect(rendered).not_to match("O&amp;#39;Toole")
end
end

0 comments on commit f5a4253

Please sign in to comment.