2011-04-11 57 views
1

我試圖實現一個鏈接,當點擊標記你作爲一個會議禮物。此鏈接是一個輔助的方法:HTML正在被轉義link_to

def link_to_remote_registration(event_id) 
    down_image = "down_blanco.png" 
    up_image = "up_blanco.png" 

    unless registration.nil? 
     if registration.present == 1 
     up_image = "up_filled.png" 
     elsif registration.present == 0 
     down_image = "down_filled.png" 
     end 
    end 

    link_to_remote_registration = String.new 
    loading_and_complete = "Element.show('indicator_event_"+event_id.to_s+"'); Element.hide('vote_"+event_id.to_s+"')".html_safe 
    complete = "Element.hide('indicator_event_"+event_id.to_s+"'); Element.show('vote_"+event_id.to_s+"')".html_safe 

    link_to_remote_registration = 
     link_to(image_tag(up_image , :id => 'will_not_attend_event_'+ event_id.to_s , border => 0), 
     :url => new_registration_path(:present => 1, :event_id => event_id, :escape => false), 
     :remote => true, 
     :method => :put, 
     :loading => loading_and_complete, 
     :complete => complete) 

    return link_to_remote_registration 
    end 

的問題是,當我呈現在我看來,一些鏈接的HTML被逃脫使得鏈接無法正常工作。

<a href="/calendar?complete=Element.hide%28%27indicator_event_1%27%29%3B+Element.show%28%27vote_1%27%29&loading=Element.show%28%27indicator_event_1%27%29%3B+Element.hide%28%27vote_1%27%29&method=put&remote=true&url=%2Fregistrations%2Fnew%3Fevent_id%3D1%26present%3D1"> 
<img id="will_not_attend_event_1" border="0" src="/images/up_blanco.png?1198181114" alt="Up_blanco"> 
</a> 

我認爲這不是一個有效的網址。我想知道爲什麼會發生這種情況 - 我在完整和加載字符串上調用html轉義。

問候

回答

0

您還可以使用的原料(),而不是禁用XSS系統範圍。

raw(image_tag(up_image , :id => 'will_not_attend_event_'+ event_id.to_s , border => 0))