cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Escape user display names.

Browse source
This commit is contained in:
Tom Hughes 2008-03-04 16:51:13 +00:00
parent cf8bd08a66
commit 0d70728fe2
4 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/views/message/_message_summary.rhtml
View file

@ -1,8 +1,8 @@
<% this_colour = cycle('lightgrey', 'white') # can only call once for some dumb reason %>
<tr class="inbox-row<%= "-unread" if not message_summary.message_read? %>">
<td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to message_summary.sender.display_name , :controller => 'user', :action => message_summary.sender.display_name %></td>
<td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to h(message_summary.title) , :controller => 'message', :action => 'read', :message_id => message_summary.id %></td>
<td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to h(message_summary.sender.display_name), :controller => 'user', :action => message_summary.sender.display_name %></td>
<td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to h(message_summary.title), :controller => 'message', :action => 'read', :message_id => message_summary.id %></td>
<td class="inbox-sent" bgcolor='<%= this_colour %>'><%= message_summary.sent_on %></td>
<% if message_summary.message_read? %>
<td><%= button_to 'Mark as unread', :controller => 'message', :action => 'mark', :message_id => message_summary.id, :mark => 'unread' %></td>

6
app/views/message/_sent_message_summary.rhtml
View file

@ -1,7 +1,7 @@
<% this_colour = cycle('lightgrey', 'white') # can only call once for some dumb reason %>
<tr class="inbox-row">
<td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to sent_message_summary.recipient.display_name , :controller => 'user', :action => sent_message_summary.recipient.display_name %></td>
<td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to h(sent_message_summary.title) , :controller => 'message', :action => 'read', :message_id => sent_message_summary.id %></td>
<td class="inbox-sent" bgcolor='<%= this_colour %>'><%= sent_message_summary.sent_on %></td>
<td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to h(sent_message_summary.recipient.display_name), :controller => 'user', :action => sent_message_summary.recipient.display_name %></td>
<td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to h(sent_message_summary.title), :controller => 'message', :action => 'read', :message_id => sent_message_summary.id %></td>
<td class="inbox-sent" bgcolor='<%= this_colour %>'><%= sent_message_summary.sent_on %></td>
</tr>

2
app/views/message/new.rhtml
View file

@ -1,7 +1,7 @@
<% display_name = User.find_by_id(params[:user_id]).display_name %>
<% title = params[:message] ? params[:message][:title] : params[:title] %>
<h2>Send a new message to <%= display_name %></h2>
<h2>Send a new message to <%= h(display_name) %></h2>
<% if params[:display_name] %>
<p>Writing a new message to <%= h(params[:display_name]) %></p>

4
app/views/message/read.rhtml
View file

@ -10,7 +10,7 @@
<%= image_tag url_for_file_column(@message.sender, "image") %>
<% end %>
<%= link_to @message.sender.display_name, :controller => 'user', :action => 'view', :display_name => @message.sender.display_name %></td>
<%= link_to h(@message.sender.display_name), :controller => 'user', :action => 'view', :display_name => @message.sender.display_name %></td>
</tr>
<tr>
<th align="right">Subject</th>
@ -43,7 +43,7 @@
<table>
<tr>
<th align="right">To</th>
<td><%= link_to @message.recipient.display_name, :controller => 'user', :action => 'view', :display_name => @message.recipient.display_name %></td>
<td><%= link_to h(@message.recipient.display_name), :controller => 'user', :action => 'view', :display_name => @message.recipient.display_name %></td>
</tr>
<tr>
<th align="right">Subject</th>