HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / user / account.rhtml

diff --git a/app/views/user/account.rhtml b/app/views/user/account.rhtml
index 9be6a1dbc788f57f56aea3a42ab53a00f1b4bf2a..1a18c90b21575eb46d54c56dee5a978a338fef9d 100644 (file)
--- a/app/views/user/account.rhtml
+++ b/app/views/user/account.rhtml
@@ -1,23 +1,20 @@
 <h2>User details</h2>
 <%= error_messages_for 'user' %>
-<% form_tag :controller => 'user', :action => 'account', :display_name => @user.display_name do %>
+<% form_for :user, @user do |f| %>
 <table style="width : 100%">
   <tr><td>Email</td><td><%= @user.email %></td></tr>
   <tr><td>Mapper since</td><td><%= @user.creation_time %> (<%= time_ago_in_words(@user.creation_time) %> ago)</td></tr>
-  <tr><td>Display Name</td><td><%= text_field :user, :display_name, :value => @user.display_name %></td></tr>
-  <tr><td>Password</td><td><%= password_field('user', 'pass_crypt',{:value => '', :size => 50, :maxlength => 255}) %></td></tr>
-  <tr><td>Confirm Password</td><td><%= password_field('user', 'pass_crypt_confirmation',{:value => '', :size => 50, :maxlength => 255}) %></td></tr>
+  <tr><td>Display Name</td><td><%= f.text_field :display_name %></td></tr>
+  <tr><td>Password</td><td><%= f.password_field :pass_crypt, {:value => '', :size => 50, :maxlength => 255} %></td></tr>
+  <tr><td>Confirm Password</td><td><%= f.password_field :pass_crypt_confirmation, {:value => '', :size => 50, :maxlength => 255} %></td></tr>
 
-  <tr><td valign="top">Description</td><td><%= text_area :user, :description, :value => @user.description, :class => "editDescription" %></td></tr>
+  <tr><td valign="top">Description</td><td><%= f.text_area :description, :class => "editDescription" %></td></tr>
 
-  <tr id="homerow" <% unless @user.home_lat and @user.home_lon %> class="nohome" <%end%> ><td>Your home</td><td><em class="message">You have not entered your home location.</em><span class="location">Latitude: <%= text_field :user, :home_lat, :value => @user.home_lat, :size => 20, :id => "home_lat" %> Longitude <%= text_field :user, :home_lon, :value => @user.home_lon, :size => 20, :id => "home_lon" %></span>  </td></tr>
+  <tr id="homerow" <% unless @user.home_lat and @user.home_lon %> class="nohome" <%end%> ><td>Your home</td><td><em class="message">You have not entered your home location.</em><span class="location">Latitude: <%= f.text_field :home_lat, :size => 20, :id => "home_lat" %> Longitude <%= f.text_field :home_lon, :size => 20, :id => "home_lon" %></span></td></tr>
 
   <tr><td></td><td>
   <p>Update home location when I click on the map? <input type="checkbox" value="1" <% unless @user.home_lat and @user.home_lon %> checked="checked" <% end %> id="updatehome" /> </p>
-  <div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px;">
-    <% # This now just used to detect the width/height required for the popup. %>
-    <p id="highlightinfo"></p>
-  </div>
+  <div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px;"></div>
   </td></tr>
 </table>
 <%= submit_tag 'Save Changes' %>
@@ -37,9 +34,9 @@
 </script>
 
 <% if @user.home_lat.nil? or @user.home_lon.nil? %>
-  <% lon =  params['lon'] || '-0.1' %>
-  <% lat =  params['lat'] || '51.5' %>
-  <% zoom =  params['zoom'] || '4' %> 
+  <% lon = h(params['lon']) || '-0.1' %>
+  <% lat = h(params['lat']) || '51.5' %>
+  <% zoom = h(params['zoom']) || '4' %> 
 <% else %>
   <% marker = true %>
   <% mlon = @user.home_lon %> 
@@ -66,7 +63,7 @@
 
     var map = createMap("map");
 
-    map.setCentre(centre, zoom);
+    map.setCenter(centre, zoom);
 
     <% if marker %>
     marker = addMarkerToMap(lonLatToMercator(new OpenLayers.LonLat(<%= mlon %>, <%= mlat %>)), null, "Your location");
@@ -106,13 +103,11 @@
 // -->
 </script>
 
-<h2>Privacy</h2>
+<h2>Public editing</h2>
 <% if @user.data_public? %>
   All your edits are public.
 <% else %>
-  Currently your edits are anonymous and people can't find out where you are located. To show what you edited and allow people to contact you through the website, click the button below. This action cannot be reversed.
+  Currently your edits are anonymous and people can't send you messages or see your location. To show what you edited and allow people to contact you through the website, click the button below. <b>You will need to do this if you want to use the online editor</b> (<a href="http://wiki.openstreetmap.org/index.php/Disabling_anonymous_edits">find out why</a>). This action cannot be reversed.
   <br /><br />
-  <% form_tag :controller => 'user', :action => 'go_public' do %>
-  <%= submit_tag 'Make all my edits public, forever' %>
-  <% end %>
+  <%= button_to "Make all my edits public, forever", :action => :go_public %>
 <% end %>