[Patch] Quotes in the summary have backslashes added

[Ryan J Ollos]

If the summary contains quotes, backslashes are added. For example, this ticket has the summary Develop the "Freeze Display" feature of the system:

[Chris Nelson]

Is this new behavior since the change to using javascript_quote()?

[Ryan J Ollos]

Replying to ChrisNelson:

Is this new behavior since the change to using javascript_quote()?

Yeah, this is tested with r10837. The issue is that javascript_quote is being executed twice on the items that build up the name string. Here is a patch:

0.11/tracjsgantt/tracjsgantt.py

@@ -940 +944 @@
                    (ticket['id'], javascript_quote(ticket['summary']),
                     javascript_quote(ticket['status']),
                     javascript_quote(ticket['type']))
-        task += 't = new JSGantt.TaskItem(%d,"%s",' % (ticket['id'], javascript_quote(name))
+        task += 't = new JSGantt.TaskItem(%d,"%s",' % (ticket['id'], name)
 
         # pStart, pEnd
         task += '"%s",' % ticket['calc_start'].strftime(self.pyDateFormat)

A second way to fix it would be to just escape the name string after it is created, which might make it more obvious that the string being executed as javascript is properly escaped.

0.11/tracjsgantt/tracjsgantt.py

@@ -931 +935 @@
         if ticket['type'] == self.milestoneType:
             if ticket['id'] < self.firstMilestoneID:
                 # Put ID number on inchpebbles
-                name = 'MS:%s (#%s)' % (javascript_quote(ticket['summary']), ticket['id'])
+                name = 'MS:%s (#%s)' % (ticket['summary'], ticket['id'])
             else:
                 # Don't show bogus ID of milestone pseudo tickets.
                 name = 'MS:%s' % ticket['summary']
         else:
             name = "#%d:%s (%s %s)" % \
-                   (ticket['id'], javascript_quote(ticket['summary']),
-                    javascript_quote(ticket['status']),
-                    javascript_quote(ticket['type']))
+                   (ticket['id'], ticket['summary'], ticket['status'],  ticket['type'])
         task += 't = new JSGantt.TaskItem(%d,"%s",' % (ticket['id'], javascript_quote(name))
 
         # pStart, pEnd

If you go with the first patch, you'll probably also want to fix this missing javascript_quote call (which is fixed implicitly by the second patch):

0.11/tracjsgantt/tracjsgantt.py

@@ -934 +938 @@
                 name = 'MS:%s (#%s)' % (javascript_quote(ticket['summary']), ticket['id'])
             else:
                 # Don't show bogus ID of milestone pseudo tickets.
-                name = 'MS:%s' % ticket['summary']
+                name = 'MS:%s' % javascript_quote(ticket['summary'])
         else:
             name = "#%d:%s (%s %s)" % \
                    (ticket['id'], javascript_quote(ticket['summary']),

[Chris Nelson]

(In [10860]) Only protect strings once. Refs #9444.

The parts of the task name were processed with javascript_quote() then the name was processed, too. This resulted in things like '\"' showing up in the chart if there were quotes in tickets summaries.

[Chris Nelson]

(In [10861]) Minor white space clean up. Refs #9444.

[Ryan J Ollos]

I've tested at r10876 and I'm seeing that this issue is resolved.