Add a few more escape calls to prevent nasty HTML being rendered. Also

[rails.git] / app / views / message / _sent_message_summary.rhtml

diff --git a/app/views/message/_sent_message_summary.rhtml b/app/views/message/_sent_message_summary.rhtml
index 69b14609a7a678ac7a45b847958b2de9a6ce9ba8..9c117bdd62bbfa66370743d0b94824cd1d605aa1 100644 (file)
--- a/app/views/message/_sent_message_summary.rhtml
+++ b/app/views/message/_sent_message_summary.rhtml
@@ -2,6 +2,6 @@
 
 <tr class="inbox-row">
   <td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to sent_message_summary.recipient.display_name , :controller => 'user', :action => sent_message_summary.recipient.display_name %></td>
 
 <tr class="inbox-row">
   <td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to sent_message_summary.recipient.display_name , :controller => 'user', :action => sent_message_summary.recipient.display_name %></td>

-  <td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to  sent_message_summary.title , :controller => 'message', :action => 'read', :message_id => sent_message_summary.id  %></td>
+  <td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to  h(sent_message_summary.title) , :controller => 'message', :action => 'read', :message_id => sent_message_summary.id  %></td>

  <td class="inbox-sent" bgcolor='<%= this_colour %>'><%= sent_message_summary.sent_on %></td>
 </tr>
  <td class="inbox-sent" bgcolor='<%= this_colour %>'><%= sent_message_summary.sent_on %></td>
 </tr>