HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / user / account.rhtml

diff --git a/app/views/user/account.rhtml b/app/views/user/account.rhtml
index 99253471d1f38b7ee0efac428d776563f1badb7e..1a18c90b21575eb46d54c56dee5a978a338fef9d 100644 (file)
--- a/app/views/user/account.rhtml
+++ b/app/views/user/account.rhtml
@@ -14,10 +14,7 @@
 
   <tr><td></td><td>
   <p>Update home location when I click on the map? <input type="checkbox" value="1" <% unless @user.home_lat and @user.home_lon %> checked="checked" <% end %> id="updatehome" /> </p>
-  <div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px;">
-    <% # This now just used to detect the width/height required for the popup. %>
-    <p id="highlightinfo"></p>
-  </div>
+  <div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px;"></div>
   </td></tr>
 </table>
 <%= submit_tag 'Save Changes' %>
@@ -37,9 +34,9 @@
 </script>
 
 <% if @user.home_lat.nil? or @user.home_lon.nil? %>
-  <% lon =  params['lon'] || '-0.1' %>
-  <% lat =  params['lat'] || '51.5' %>
-  <% zoom =  params['zoom'] || '4' %> 
+  <% lon = h(params['lon']) || '-0.1' %>
+  <% lat = h(params['lat']) || '51.5' %>
+  <% zoom = h(params['zoom']) || '4' %> 
 <% else %>
   <% marker = true %>
   <% mlon = @user.home_lon %> 
@@ -106,11 +103,11 @@
 // -->
 </script>
 
-<h2>Privacy</h2>
+<h2>Public editing</h2>
 <% if @user.data_public? %>
   All your edits are public.
 <% else %>
-  Currently your edits are anonymous and people can't find out where you are located. To show what you edited and allow people to contact you through the website, click the button below. This action cannot be reversed.
+  Currently your edits are anonymous and people can't send you messages or see your location. To show what you edited and allow people to contact you through the website, click the button below. <b>You will need to do this if you want to use the online editor</b> (<a href="http://wiki.openstreetmap.org/index.php/Disabling_anonymous_edits">find out why</a>). This action cannot be reversed.
   <br /><br />
   <%= button_to "Make all my edits public, forever", :action => :go_public %>
 <% end %>