From 78e0ec74f74721a2652b7c950d0aa501363bceef Mon Sep 17 00:00:00 2001
From: =?utf8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?=
 <avarab@gmail.com>
Date: Thu, 1 Oct 2009 20:02:54 +0000
Subject: [PATCH] use h() to avoid XSS in usernames

---
 app/views/user_blocks/edit.html.erb | 2 +-
 app/views/user_blocks/new.html.erb  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/user_blocks/edit.html.erb b/app/views/user_blocks/edit.html.erb
index 66123e717..c52c94818 100644
--- a/app/views/user_blocks/edit.html.erb
+++ b/app/views/user_blocks/edit.html.erb
@@ -8,7 +8,7 @@
   <%= f.error_messages %>
 
   <p>
-    <%= f.label :reason, t('user_block.edit.reason', :name => @user_block.user.display_name) %><br />
+    <%= f.label :reason, t('user_block.edit.reason', :name => h(@user_block.user.display_name)) %><br />
     <%= f.text_area :reason %>
   </p>
   <p>
diff --git a/app/views/user_blocks/new.html.erb b/app/views/user_blocks/new.html.erb
index 3d0d2d0bf..470d60e8f 100644
--- a/app/views/user_blocks/new.html.erb
+++ b/app/views/user_blocks/new.html.erb
@@ -1,4 +1,4 @@
-<h1><%= t('user_block.new.title', :name => @this_user.display_name) %></h1>
+<h1><%= t('user_block.new.title', :name => h(@this_user.display_name)) %></h1>
 
 <% form_for(@user_block) do |f| %>
   <%= f.error_messages %>
-- 
2.43.2