More escaping.

[rails.git] / app / views / diary_entry / list.rhtml

diff --git a/app/views/diary_entry/list.rhtml b/app/views/diary_entry/list.rhtml
index 7d592d87e24eb545abb84fcb7ebdf0d6e44a37b6..dd90de1697f70bc723265ba4ee313af1785224a8 100644 (file)
--- a/app/views/diary_entry/list.rhtml
+++ b/app/views/diary_entry/list.rhtml
@@ -1,8 +1,9 @@
-<h2><%= @title %></h2>
+<h2><%= h(@title) %></h2>
 
-<% if @this_user.image %>
+<% if @this_user && @this_user.image %>
  <%= image_tag url_for_file_column(@this_user, "image") %>
 <% end %>
+
 <br />
 
 <% if @this_user %>