use h() to avoid XSS in usernames

diff --git a/app/views/user_blocks/edit.html.erb b/app/views/user_blocks/edit.html.erb
index 66123e717959d2f64434e295c042f69b5ea78d0a..c52c94818e2f33fc44fbffe4b335f3636bcd2477 100644 (file)
--- a/app/views/user_blocks/edit.html.erb
+++ b/app/views/user_blocks/edit.html.erb
@@ -8,7 +8,7 @@
   <%= f.error_messages %>
 
   <p>
   <%= f.error_messages %>
 
   <p>

-    <%= f.label :reason, t('user_block.edit.reason', :name => @user_block.user.display_name) %><br />
+    <%= f.label :reason, t('user_block.edit.reason', :name => h(@user_block.user.display_name)) %><br />

     <%= f.text_area :reason %>
   </p>
   <p>
     <%= f.text_area :reason %>
   </p>
   <p>

diff --git a/app/views/user_blocks/new.html.erb b/app/views/user_blocks/new.html.erb
index 3d0d2d0bf754651115639df4569368d6ef8d919e..470d60e8f2c1693a90f0fcf40c6c521df008e2a6 100644 (file)
--- a/app/views/user_blocks/new.html.erb
+++ b/app/views/user_blocks/new.html.erb
@@ -1,4 +1,4 @@
-<h1><%= t('user_block.new.title', :name => @this_user.display_name) %></h1>
+<h1><%= t('user_block.new.title', :name => h(@this_user.display_name)) %></h1>

 
 <% form_for(@user_block) do |f| %>
   <%= f.error_messages %>
 
 <% form_for(@user_block) do |f| %>
   <%= f.error_messages %>