Fix mentioning users with certain characters renders incorrectly (#37755).

Patch Mizuki ISHIKAWA.


git-svn-id: https://svn.redmine.org/redmine/trunk@21986 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 10 insertions, 0 deletions

diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb
index a5c533a4f..b4d194da9 100644
--- a/test/helpers/application_helper_test.rb
+++ b/test/helpers/application_helper_test.rb
@@ -1841,6 +1841,16 @@ class ApplicationHelperTest < Redmine::HelperTest
     assert_equal result, link_to_principal(unknown_principal, :class => 'bar')
   end
 
+  def test_link_to_principal_should_escape_principal_name
+    user = User.generate!(firstname: "firstname<>'", lastname: 'lastname&"')
+    group = Group.generate!(lastname: "group<>'&")
+
+    assert_include "firstname&lt;&gt;&#39; lastname&amp;&quot;", link_to_principal(user)
+    assert_include "@firstname&lt;&gt;&#39; lastname&amp;&quot;", link_to_principal(user, { mention: true })
+    assert_include "group&lt;&gt;&#39;&amp;", link_to_principal(group)
+    assert_include "&lt;&gt;&#39;&amp;", link_to_principal("<>'&")
+  end
+
   def test_link_to_group_should_return_only_group_name_for_non_admin_users
     User.current = nil
     group = Group.find(10)