Add an ACL system to allow key/value pairs to be attached to blocks

[rails.git] / app / views / site / _search.rhtml

diff --git a/app/views/site/_search.rhtml b/app/views/site/_search.rhtml
index 19b4ca2d1351d199ffa1ce31afb326e61cf0243a..6ddcc851cd640bab7ac4495d3d18f45013f49e81 100644 (file)
--- a/app/views/site/_search.rhtml
+++ b/app/views/site/_search.rhtml
@@ -1,7 +1,7 @@
 <script type="text/javascript">
 <!--
   function startSearch() {
-    updateSidebar("Search Results", "<p class='search_results_entry'>Searching...</p>");
+    updateSidebar("Search Results", "<p class='search_results_entry'>Searching...<\/p>");
 
     $("search_field").style.display = "none";
     $("search_active").style.display = "inline";
@@ -24,7 +24,7 @@
   <% if params[:query] %>
   <%= remote_function(:loading => "startSearch()",
                       :complete => "endSearch()",
-                      :url => { :controller => :geocoder, :action => :search, :query => params[:query] }) %>
+                      :url => { :controller => :geocoder, :action => :search, :query => h(params[:query]) }) %>
   <% end %>
 // -->
 </script>
@@ -34,13 +34,14 @@
     <span class="oboxheader">Search</span>
     <span class="whereami"><a href="javascript:describeLocation()">Where am I?</a></span>
     <div class="search_form">
-    <span id="search_field">
+    <div id="search_field">
     <% form_remote_tag(:loading => "startSearch()",
                        :complete => "endSearch()",
                        :url => { :controller => :geocoder, :action => :search }) do %>
-      <%= text_field_tag :query, params[:query] %>
+      <%= text_field_tag :query, h(params[:query]) %>
+      <%= submit_tag "Go" %>
     <% end %>
-    </span>
+    </div>
     <p id="search_active">Searching...</p>
     </div>
     <p class="search_help">