Escape user-supplied JavaScript. Fixes http://lists.openstreetmap.org/pipermail/talk...

[rails.git] / app / views / message / _message_summary.html.erb

diff --git a/app/views/message/_message_summary.html.erb b/app/views/message/_message_summary.html.erb
index 49190fd936e16326f57cd2757a8069ad85169411..3d9976aab6e8162ca9855803100910b3ce3256b4 100644 (file)
--- a/app/views/message/_message_summary.html.erb
+++ b/app/views/message/_message_summary.html.erb
@@ -10,4 +10,5 @@
     <td><%= button_to t('message.message_summary.read_button'), :controller => 'message', :action => 'mark', :message_id => message_summary.id, :mark => 'read' %></td>
   <% end %>
   <td><%= button_to t('message.message_summary.reply_button'), :controller => 'message', :action => 'reply', :message_id => message_summary.id %></td>
+  <td><%= button_to t('message.message_summary.delete_button'), :controller => 'message', :action => 'delete', :message_id => message_summary.id, :referer => request.request_uri %></td>
 </tr>