More escaping.

[rails.git] / app / views / diary_entry / list.rhtml

diff --git a/app/views/diary_entry/list.rhtml b/app/views/diary_entry/list.rhtml
index 0ac45f9d220271dc8bd7835d6dbc1e413c694fcf..dd90de1697f70bc723265ba4ee313af1785224a8 100644 (file)
--- a/app/views/diary_entry/list.rhtml
+++ b/app/views/diary_entry/list.rhtml
@@ -1,4 +1,11 @@
-<h2><%= @title %></h2>
+<h2><%= h(@title) %></h2>
+
+<% if @this_user && @this_user.image %>
+ <%= image_tag url_for_file_column(@this_user, "image") %>
+<% end %>
+
+<br />
+
 <% if @this_user %>
   <% if @user == @this_user %>
     <%= link_to 'New diary post', :controller => 'diary_entry', :action => 'new', :display_name => @user.display_name %>