xxqfamous / qrcode-rails Goto Github PK

I have created a qrcode gem that may well be useful to your project as it moves 
the qrcode 
generation back to the server and not on the client.

http://rubyforge.org/projects/rqrcode/

sudo yum install rqrcode

Best.
Duncan

Upon loading the JavaScript in a jQuery environment qrcode.rb calls Prototype. 

replacing the Element.update line with this line will fix it. 

$(text).appendTo('##{id}');

What steps will reproduce the problem?
1. Use XHTML (mime-type application/xhtml or xml).

Solution: put "/* <![CDATA */" and "/* ]]> */" around Javascript code to
make it compatible with both HTML and XHTML (and XML-like HTML5).

This issue is slightly connected to #2.

There's a line in lib/qrcode.rb:

qr.addData('#{url}');

There is a problem with user-specified data. URL must not be included here
lierally (as in example above), there must be escaping applied before
according to displayed document type. In HTML and XHTML the best is to use
.to_json that will change URL to appropiate Javascript object - string.

It will then be:

qr.addData(#{url.to_json});

It will ensure that user will not escape from string with characters like '
in URL.

In XHTML, if script is included inside CDATA section, there must be
additional escaping of ]]> to prevent user from escaping to HTML by
including "]]>" in his URL.

gsub(']]>', ']]>]]&gt;<![CDATA[')

This arises second problem: qrcode does not know if it should escape "]]>",
because it does not know if document is XHTML. There might be additional
parameter for this (don't check content-type, because it might be set by
user in after_filters). So in the end it might be:

def qrcode(url, size=2, level=4, id=nil, xhtml=false)
…
qr.addData (#{xhtml ? url.to_json.gsub(']]>', ']]>]]&gt;<![CDATA[') :
url.to_json});

(Notice that .to_json must be first before escaping ]]> sequences in XHTML).

Regards. :p

Rails 3 deprection of:
#ActionView::Helpers::AssetTagHelper::register_javascript_include_default('qrcod
e')

Should be changed to:
ActionView::Helpers::AssetTagHelper.register_javascript_expansion :qrcode => 
["qrcode"]