X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/6c76e5ce6520a465ff741e4510eafc757738e9ba..30d63b582ed093d235ae4a9efdeda5de1d4e2f24:/apps/workbench/app/views/application/_selection_checkbox.html.erb

diff --git a/apps/workbench/app/views/application/_selection_checkbox.html.erb b/apps/workbench/app/views/application/_selection_checkbox.html.erb
index 732c343d26..9645455ace 100644
--- a/apps/workbench/app/views/application/_selection_checkbox.html.erb
+++ b/apps/workbench/app/views/application/_selection_checkbox.html.erb
@@ -1,9 +1,18 @@
-<%if object %>
+<%if object and object.class.goes_in_folders? %>
+  <% fn = if defined? friendly_name
+            friendly_name
+          else
+            link_to_if_arvados_object object, {no_link: true}
+          end
+     %>
+  <% # This 'fn' string may contain embedded HTML which is already marked html_safe.
+     # Since we are putting it into a tag attribute, we need to copy into an
+     # unsafe string so that rails will escape it for us.
+     fn = String.new fn %>
 <%= check_box_tag 'uuids[]', object.uuid, false, {
       :class => 'persistent-selection',
       :friendly_type => object.class.name,
-      :friendly_name => (if defined? friendly_name then friendly_name
-                         else link_to_if_arvados_object object, {:no_link => true} end),
+      :friendly_name => fn,
       :href => "#{url_for controller: object.class.name.tableize, action: 'show', id: object.uuid }",
       :title => "Click to add this item to your selection list"
 } %>