Merge pull request #265 from TrackIF/escape-experiment-names

Experiments with single-quotes break "Use This" functionality
splitrb · Sep 16, 2014 · f4c0a9d · f4c0a9d
2 parents 30ca3a1 + 9d97105
commit f4c0a9d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/lib/split/dashboard/helpers.rb b/lib/split/dashboard/helpers.rb
@@ -1,5 +1,9 @@
 module Split
   module DashboardHelpers
+    def h(text)
+      Rack::Utils.escape_html(text)
+    end
+
     def url(*path_parts)
       [ path_prefix, path_parts ].join("/").squeeze('/')
     end

diff --git a/lib/split/dashboard/views/_experiment.erb b/lib/split/dashboard/views/_experiment.erb
@@ -71,7 +71,7 @@
             <% end %>
           <% else %>
             <form action="<%= url experiment.name %>" method='post' onclick="return confirmWinner()">
-              <input type='hidden' name='alternative' value='<%= alternative.name %>'>
+              <input type='hidden' name='alternative' value='<%= h alternative.name %>'>
               <input type="submit" value="Use this" class="green">
             </form>
           <% end %>