Escape message titles and bodies. This is an emergency fix as some genius

[rails.git] / app / views / user / account.rhtml

diff --git a/app/views/user/account.rhtml b/app/views/user/account.rhtml
index 99253471d1f38b7ee0efac428d776563f1badb7e..c5312686adfa1f77204a0cd4ce088d797ca9cdd9 100644 (file)
--- a/app/views/user/account.rhtml
+++ b/app/views/user/account.rhtml
@@ -14,10 +14,7 @@
 
   <tr><td></td><td>
   <p>Update home location when I click on the map? <input type="checkbox" value="1" <% unless @user.home_lat and @user.home_lon %> checked="checked" <% end %> id="updatehome" /> </p>
-  <div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px;">
-    <% # This now just used to detect the width/height required for the popup. %>
-    <p id="highlightinfo"></p>
-  </div>
+  <div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px;"></div>
   </td></tr>
 </table>
 <%= submit_tag 'Save Changes' %>
@@ -37,9 +34,9 @@
 </script>
 
 <% if @user.home_lat.nil? or @user.home_lon.nil? %>
-  <% lon =  params['lon'] || '-0.1' %>
-  <% lat =  params['lat'] || '51.5' %>
-  <% zoom =  params['zoom'] || '4' %> 
+  <% lon = h(params['lon'] || '-0.1') %>
+  <% lat = h(params['lat'] || '51.5') %>
+  <% zoom = h(params['zoom'] || '4') %> 
 <% else %>
   <% marker = true %>
   <% mlon = @user.home_lon %> 
@@ -49,7 +46,8 @@
   <% zoom =  '12' %>
 <% end %>
 
-<script type="text/javascript" src="/openlayers/OpenLayers.js"></script>
+<%= javascript_include_tag '/openlayers/OpenLayers.js' %>
+<%= javascript_include_tag '/openlayers/OpenStreetMap.js' %>
 <%= javascript_include_tag 'map.js' %>
 
 <script type="text/javascript">
@@ -106,11 +104,11 @@
 // -->
 </script>
 
-<h2>Privacy</h2>
+<h2>Public editing</h2>
 <% if @user.data_public? %>
   All your edits are public.
 <% else %>
-  Currently your edits are anonymous and people can't find out where you are located. To show what you edited and allow people to contact you through the website, click the button below. This action cannot be reversed.
+  Currently your edits are anonymous and people can't send you messages or see your location. To show what you edited and allow people to contact you through the website, click the button below. <b>You will need to do this if you want to use the online editor</b> (<a href="http://wiki.openstreetmap.org/index.php/Disabling_anonymous_edits">find out why</a>). This action cannot be reversed.
   <br /><br />
   <%= button_to "Make all my edits public, forever", :action => :go_public %>
 <% end %>