Escape user-supplied JavaScript. Fixes http://lists.openstreetmap.org/pipermail/talk...

[rails.git] / app / views / changeset / _changeset.html.erb

diff --git a/app/views/changeset/_changeset.html.erb b/app/views/changeset/_changeset.html.erb
index 314510eb835e396c18ea531289df912e2f1c076c..650030688eb82d431faf084cc47f5e1063a94243 100644 (file)
--- a/app/views/changeset/_changeset.html.erb
+++ b/app/views/changeset/_changeset.html.erb
@@ -2,12 +2,17 @@
   <% cl = cycle('table0', 'table1') %>
 
   <td class="<%= cl %>">
-    #<%= changeset.id %>
+    <%=
+      id_link = link_to(changeset.id,
+                        {:controller => 'browse', :action => 'changeset', :id => changeset.id},
+                        {:title => t('changeset.changeset.view_changeset_details')})
+      t'changeset.changeset.id', :id => id_link
+    %>
   </td>
 
   <td class="<%= cl %> date">
     <% if changeset.closed_at > DateTime.now %> <%= t'changeset.changeset.still_editing' %>
-    <% else %><%= changeset.closed_at.strftime("%d %b %Y %H:%M") %><% end %>
+    <% else %><%= l changeset.closed_at, :format => :long %><% end %>
   </td>
 
     
@@ -23,7 +28,7 @@
     
   <td class="<%= cl %> comment">
     <% if changeset.tags['comment'] %>
-      <%= h(changeset.tags['comment']) %>
+      <%= auto_link(h(changeset.tags['comment'])) %>
     <% else %>
       <%= t'changeset.changeset.no_comment' %>
     <% end %>
@@ -41,15 +46,11 @@
       <a href='/?minlon=<%= minlon %>&minlat=<%= minlat %>&maxlon=<%= maxlon %>&maxlat=<%= maxlat %>&box=yes' title='<%= t'changeset.changeset.show_area_box' %>'><%= format("%0.3f",minlon) -%>,<%= format("%0.3f",minlat) -%>,<%= format("%0.3f",maxlon) -%>,<%= format("%0.3f",maxlat) -%></a>
       <!--<%=changeset.area%>-->
     <%   if changeset.area > 1500000000000 %>
-      <% t'changeset.changeset.big_area' %>
+      <%= t'changeset.changeset.big_area' %>
     <%
          end
        end
     %>
   </td>
 
-  <td class="<%= cl %>">
-    <%= link_to t('changeset.changeset.more'), {:controller => 'browse', :action => 'changeset', :id => changeset.id}, {:title => t('changeset.changeset.view_changeset_details')} %> 
-  </td>
-
 </tr>