Escape user-supplied JavaScript. Fixes http://lists.openstreetmap.org/pipermail/talk...
authorÆvar Arnfjörð Bjarmason <avarab@gmail.com>
Tue, 29 Sep 2009 09:23:11 +0000 (09:23 +0000)
committerÆvar Arnfjörð Bjarmason <avarab@gmail.com>
Tue, 29 Sep 2009 09:23:11 +0000 (09:23 +0000)
app/views/site/edit.html.erb

index 948b1fad5122b1a3adc6394537ef995f79cee49f..d3258c9cfa902c61f3c853d4c864e2ddd35bb70e 100644 (file)
@@ -65,7 +65,7 @@ zoom='14' if zoom.nil?
   
   window.onbeforeunload=function() {
     if (!changesaved) {
   
   window.onbeforeunload=function() {
     if (!changesaved) {
-      return "<%= t 'site.edit.potlatch_unsaved_changes' %>";
+      return '#{escape_javascript(t('site.edit.potlatch_unsaved_changes'))}';
     }
   }
 
     }
   }