Escape user names in diary views.

diff --git a/app/views/diary_entry/_diary_comment.rhtml b/app/views/diary_entry/_diary_comment.rhtml
index be621cf5b7d4b68f39077c276236e575f74f243b..2aca51f545c89d2f4adc1b4aedf5d9e32e4fd6b7 100644 (file)
--- a/app/views/diary_entry/_diary_comment.rhtml
+++ b/app/views/diary_entry/_diary_comment.rhtml
@@ -1,3 +1,3 @@
-<h4 id="comment<%= diary_comment.id %>">Comment from <%= link_to diary_comment.user.display_name, :controller => 'user', :action => 'view', :display_name => diary_comment.user.display_name %>  at <%= diary_comment.created_at %></h4>
+<h4 id="comment<%= diary_comment.id %>">Comment from <%= link_to h(diary_comment.user.display_name), :controller => 'user', :action => 'view', :display_name => diary_comment.user.display_name %>  at <%= diary_comment.created_at %></h4>
 <%= htmlize(diary_comment.body) %>
 <hr />

diff --git a/app/views/diary_entry/_diary_entry.rhtml b/app/views/diary_entry/_diary_entry.rhtml
index 8ff7afd34aa32249fd5926d757b5e687f28d4cf0..372ec35f7f0784483b3f8b0928a459fa58ee83d6 100644 (file)
--- a/app/views/diary_entry/_diary_entry.rhtml
+++ b/app/views/diary_entry/_diary_entry.rhtml
@@ -3,7 +3,7 @@
 <% if diary_entry.latitude and diary_entry.longitude %>
 Coordinates: <div class="geo" style="display: inline"><span class="latitude"><%= diary_entry.latitude %></span>; <span class="longitude"><%= diary_entry.longitude %></span></div> (<%=link_to 'map', :controller => 'site', :action => 'index', :lat => diary_entry.latitude, :lon => diary_entry.longitude, :zoom => 14 %> / <%=link_to 'edit', :controller => 'site', :action => 'edit', :lat => diary_entry.latitude, :lon => diary_entry.longitude, :zoom => 14 %>)<br/>
 <% end %>
-Posted by <b><%= link_to diary_entry.user.display_name, :controller => 'user', :action => 'view', :display_name => diary_entry.user.display_name %></b> at <%= diary_entry.created_at %><br />
+Posted by <b><%= link_to h(diary_entry.user.display_name), :controller => 'user', :action => 'view', :display_name => diary_entry.user.display_name %></b> at <%= diary_entry.created_at %><br />
 <% if params[:action] == 'list' %>
 <%= link_to 'Comment on this entry', :action => 'view', :display_name => diary_entry.user.display_name, :id => diary_entry.id, :anchor => 'newcomment' %>
 |

diff --git a/app/views/diary_entry/view.rhtml b/app/views/diary_entry/view.rhtml
index ca678c50b02472dd9eedcf5f6d95d18d600e9898..6e1f75a32bd0e30251f681458c93262b8be1a9c4 100644 (file)
--- a/app/views/diary_entry/view.rhtml
+++ b/app/views/diary_entry/view.rhtml
@@ -1,4 +1,4 @@
-<h2><%= @entry.user.display_name %>'s diary</h2>
+<h2><%= h(@entry.user.display_name) %>'s diary</h2>
 
 <%= render :partial => 'diary_entry', :object => @entry %>