openstreetmap-website/app/views/diary_entry/_diary_entry.rhtml
Tom Hughes 1e54573bae Escape message titles and bodies. This is an emergency fix as some genius
has decided to report this XSS problem to a public mailing list. Unfortunately
it means that some functionality (links in messages etc) has been lost for now.
2008-01-15 00:26:01 +00:00

8 lines
816 B
Text

<b><%= h(diary_entry.title) %></b><br />
<%= simple_format(h(diary_entry.body)) %>
<% if diary_entry.latitude and diary_entry.longitude %>
Coordinates: <div class="geo" style="display: inline"><span class="latitude"><%= diary_entry.latitude %></span>; <span class="longitude"><%= diary_entry.longitude %></span></div> (<%=link_to 'map', :controller => 'site', :action => 'index', :lat => diary_entry.latitude, :lon => diary_entry.longitude, :zoom => 14 %> / <%=link_to 'edit', :controller => 'site', :action => 'edit', :lat => diary_entry.latitude, :lon => diary_entry.longitude, :zoom => 14 %>)<br/>
<% end %>
Posted by <b><%= link_to diary_entry.user.display_name, :controller => 'user', :action => 'view', :display_name => diary_entry.user.display_name %></b> at <%= diary_entry.created_at %><br />
<br />
<hr />