Escape message titles and bodies. This is an emergency fix as some genius

[rails.git] / app / views / diary_entry / new.rhtml

diff --git a/app/views/diary_entry/new.rhtml b/app/views/diary_entry/new.rhtml
index 8daf769c4d266ed3265dbc82943fdd0ca6f07321..7ee1eeaede5f1d6991583bd7547ad7c685333986 100644 (file)
--- a/app/views/diary_entry/new.rhtml
+++ b/app/views/diary_entry/new.rhtml
@@ -8,12 +8,12 @@
     </tr>
     <tr valign="top">
       <th>Body</th>
-      <td><%= f.text_area :body, :cols => 80, :rows => 10 %></td>
+      <td><%= f.text_area :body, :cols => 80 %></td>
     </tr>
     <tr valign="top">
            <th>Location</th>
-           <td><div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 250px;"></div><br/>
-                 <span class="location">Latitude: <%= f.text_field :latitude, :size => 20, :id => "latitude" %> Longitude <%= f.text_field :longitude, :size => 20, :id => "longitude" %></span></td>
+           <td><a name="map"></a><div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px; display: none;"></div>
+                 <span class="location">Latitude: <%= f.text_field :latitude, :size => 20, :id => "latitude" %> Longitude: <%= f.text_field :longitude, :size => 20, :id => "longitude" %></span> <a href="#map" id="usemap" onclick="document.getElementById('map').style.display = 'block'; document.getElementById('usemap').style.display = 'none';">use map</a> </td>
          </tr>
     <tr>
       <th></th>
@@ -23,16 +23,17 @@
 <% end %>
 
 <% if @user.home_lat.nil? or @user.home_lon.nil? %>
-  <% lon =  params['lon'] || '-0.1' %>
-  <% lat =  params['lat'] || '51.5' %>
-  <% zoom =  params['zoom'] || '4' %> 
+  <% lon = h(params['lon'] || '-0.1') %>
+  <% lat = h(params['lat'] || '51.5') %>
+  <% zoom = h(params['zoom'] || '4') %> 
 <% else %>
-  <% lon =  @user.home_lon %>
-  <% lat =  @user.home_lat %>
-  <% zoom =  '12' %>
+  <% lon = @user.home_lon %>
+  <% lat = @user.home_lat %>
+  <% zoom = '12' %>
 <% end %>
 
-<script type="text/javascript" src="/openlayers/OpenLayers.js"></script>
+<%= javascript_include_tag '/openlayers/OpenLayers.js' %>
+<%= javascript_include_tag '/openlayers/OpenStreetMap.js' %>
 <%= javascript_include_tag 'map.js' %>
 
 <script type="text/javascript">
@@ -68,4 +69,4 @@
 
   window.onload = init;
 // -->
-</script>
\ No newline at end of file
+</script>