cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

HTML escape substituted parameter values to avoid injection attacks.

Browse source
This commit is contained in:
Tom Hughes 2007-11-23 00:49:55 +00:00
parent 7b172efeb6
commit 2cbcabb3f6
7 changed files with 39 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/views/message/new.rhtml
View file

@ -3,7 +3,7 @@
<h2>Send a new message to <%= display_name %></h2>
<% if params[:display_name] %>
<p>Writing a new message to <%= params[:display_name] %></p>
<p>Writing a new message to <%= h(params[:display_name]) %></p>
<p>TODO: drop down box of your friends</p>
<%end%>