Fixed #9924 - yii.js handleAction corrupted parameters with quote char

framework/CHANGELOG.md

@@ -25,6 +25,7 @@ Yii Framework 2 Change Log
 - Bug #9883: Passing a single `yii\db\Expression` to `Query::select()` or `::addSelect()` was not handled correctly in all cases (cebe)
 - Bug #9911: Fixed `yii\helpers\BaseStringHelper::explode()` code so it does not remove items eq to 0 with skip_empty attribute (silverfire, kidol)
 - Bug #9915: `yii\helpers\ArrayHelper::getValue()` was erroring instead of returning `null` for non-existing object properties (totaldev, samdark)
+- Bug #9924: Fixed `yii.js` handleAction corrupted parameter values containing quote (") character (silverfire)
 - Bug: Fixed generation of canonical URLs for `ViewAction` pages (samdark)
 - Enh #7581: Added ability to specify range using anonymous function in `RangeValidator` (RomeroMsk)
 - Enh #8613: `yii\widgets\FragmentCache` will not store empty content anymore which fixes some problems related to `yii\filters\PageCache` (kidol)

framework/assets/yii.js

@@ -191,7 +191,7 @@ yii = (function ($) {
             // temporarily add hidden inputs according to data-params
             if (params && $.isPlainObject(params)) {
                 $.each(params, function (idx, obj) {
-                    $form.append('<input name="' + idx + '" value="' + obj + '" type="hidden">');
+                    $form.append($('<input>').attr({name: idx, value: obj, type: 'hidden'}));
                 });
             }