Escape usernames. Closes #2149.

diff --git a/app/views/user/_friend_map.html.erb b/app/views/user/_friend_map.html.erb
index 72f02bd61163b6281de5012c0af6fe4de1cda7e1..75303f10d349b3e6fdd1288c2501a449114efb86 100644 (file)
--- a/app/views/user/_friend_map.html.erb
+++ b/app/views/user/_friend_map.html.erb
@@ -2,7 +2,7 @@
 <% if !@user.home_lat.nil? and !@user.home_lon.nil? %>
   <% if !@user.nearby.empty? %>
     <% @user.nearby.each do |nearby| %>
-    <% nearest_str += "nearest.push( { 'display_name' : '#{nearby.display_name}', 'home_lat' : #{nearby.home_lat}, 'home_lon' : #{nearby.home_lon} } );\n" %>
+    <% nearest_str += "nearest.push( { 'display_name' : '#{escape_javascript(nearby.display_name)}', 'home_lat' : #{nearby.home_lat}, 'home_lon' : #{nearby.home_lon} } );\n" %>
     <% end %>
   <% end %>
 <% end %>