Rails 3 escaping

[rchekaluk]

When upgrading my app to Rails 3 I encountered an issue with collection_table escaping the generated content. I tried various ways of working around this, and none worked: (a) calling html_safe against each of the strings I passed to collection_table, (b) using <%=raw in the first line, and (c) putting each line into its own erb <%=raw %> line.

The solution that worked was to modify content_tag calls in table_helper to disable the escaping.

Here are some of the references I used:
http://stackoverflow.com/questions/3863844/rails-how-to-build-table-in-helper-using-content-tag/
http://asciicasts.com/episodes/204-xss-protection-in-rails-3/
http://railsdispatch.com/posts/security/
http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/

[averissimo]

+1

[scottillogical]

+1

[marcandre]

Pull request is not the right way to go. See my pull request #8