Escape user names in diary views.

This commit is contained in:
Tom Hughes 2008-03-04 16:49:12 +00:00
parent 6c15eb7251
commit cf8bd08a66
3 changed files with 3 additions and 3 deletions

View file

@ -1,4 +1,4 @@
<h2><%= @entry.user.display_name %>'s diary</h2>
<h2><%= h(@entry.user.display_name) %>'s diary</h2>
<%= render :partial => 'diary_entry', :object => @entry %>