Rails 2.3.7 and navigation plugin

On Monday Rails 2.3.6 came out. And then today Rails 2.3.7 came out. I upgraded a few apps today and realized the new XSS safe-by-default stuff broke my navigation plugin.

I considered updating the master branch with the fixes, but I’m going to hold off on that for now, since it will break in Rails 2.3.5 and below. Not everyone wants to upgrade to the latest 2.3.7 release just yet, but I can’t imagine why not :-)

Anyway, here are the (simple) fixes required to get the plugin working with Rails 2.3.7.

Plugin load order

First up, make sure you have the official rails_xss plugin installed. Then you need to tell Rails to load this plugin first, so that the navigation plugin can make use of the new XSS methods. Here’s how to do that. In environment.rb:

1

config.plugins = [ :rails_xss, :all ]

Load the rails_xss plugin, then everything else.

Making the output html_safe

init.rb—Tell ActionView::Base that the navigation helper is safe. Change this:

1
2
3

ActionView::Base.class_eval do
  include RPH::Navigation::Helpers
end

to this:

1
2
3
4

ActionView::Base.class_eval do
  include RPH::Navigation::Helpers
  self.safe_helper :navigation
end

navigator.rb—Ensure that the links are safe. At the end of the block (around line 81) do this:

1
2
3

links = menu.inject([]) do |items, (item, opts)|
  # ...
end.join("\n").html_safe

That’s about it. Now the plugin should behave as it always has.

Oh, there’s one more thing. If you will be passing HTML to the :text option in the menu configuration, you’ll need to ensure that the link text is safe as well.

navigator.rb—Change this line (around line 109):

1

[text, path, attrs]

to this:

1

[text.html_safe, path, attrs]

That should do it. Now if you have :text => "About & Tour" you’ll get the proper output. If you run into any other issues, let me know.