Escape data attributes in template.

This fixes a bug whereby a double quote in an item would not be JSON-escaped
due to being HTML-escaped first, meaning it would not parse as JSON on the
client.

3 files changed, 5 insertions, 8 deletions

diff --git a/perllib/FixMyStreet/DB/ResultSet/DefectType.pm b/perllib/FixMyStreet/DB/ResultSet/DefectType.pm
index b2ef77f7c..5b1247129 100644
--- a/perllib/FixMyStreet/DB/ResultSet/DefectType.pm
+++ b/perllib/FixMyStreet/DB/ResultSet/DefectType.pm
@@ -4,7 +4,6 @@ use base 'DBIx::Class::ResultSet';
 use strict;
 use warnings;
 use Moo;
-use HTML::Entities;
 
 with('FixMyStreet::Roles::ContactExtra');
 
@@ -16,10 +15,10 @@ sub map_extras {
     my ($rs, @ts) = @_;
     return map {
         my $meta = $_->get_extra_metadata();
-        my %extra = map { $_ => encode_entities($meta->{$_}) } keys %$meta;
+        my %extra = map { $_ => $meta->{$_} } keys %$meta;
         {
             id => $_->id,
-            name => encode_entities($_->name),
+            name => $_->name,
             extra => \%extra
         }
     } @ts;
diff --git a/perllib/FixMyStreet/DB/ResultSet/ResponsePriority.pm b/perllib/FixMyStreet/DB/ResultSet/ResponsePriority.pm
index 89bb4dfd7..96f7cf7a0 100644
--- a/perllib/FixMyStreet/DB/ResultSet/ResponsePriority.pm
+++ b/perllib/FixMyStreet/DB/ResultSet/ResponsePriority.pm
@@ -4,7 +4,6 @@ use base 'DBIx::Class::ResultSet';
 use strict;
 use warnings;
 use Moo;
-use HTML::Entities;
 
 with('FixMyStreet::Roles::ContactExtra');
 
@@ -14,7 +13,7 @@ sub join_table {
 
 sub map_extras {
     my ($rs, @ts) = @_;
-    return map { { id => $_->id, name => encode_entities($_->name) } } @ts;
+    return map { { id => $_->id, name => $_->name } } @ts;
 }
 
 1;
diff --git a/perllib/FixMyStreet/DB/ResultSet/ResponseTemplate.pm b/perllib/FixMyStreet/DB/ResultSet/ResponseTemplate.pm
index aa070daa3..46fcba153 100644
--- a/perllib/FixMyStreet/DB/ResultSet/ResponseTemplate.pm
+++ b/perllib/FixMyStreet/DB/ResultSet/ResponseTemplate.pm
@@ -2,7 +2,6 @@ package FixMyStreet::DB::ResultSet::ResponseTemplate;
 use base 'DBIx::Class::ResultSet';
 
 use Moo;
-use HTML::Entities;
 
 with('FixMyStreet::Roles::ContactExtra');
 
@@ -17,8 +16,8 @@ sub name_column {
 sub map_extras {
     my ($rs, @ts) = @_;
     return map {
-        my $out = { id => encode_entities($_->text), name => encode_entities($_->title) };
-        $out->{state} = encode_entities($_->state) if $_->state;
+        my $out = { id => $_->text, name => $_->title };
+        $out->{state} = $_->state if $_->state;
         $out;
     } @ts;
 }