Add a few more escape calls to prevent nasty HTML being rendered. Also

[rails.git] / app / views / user / view.rhtml

diff --git a/app/views/user/view.rhtml b/app/views/user/view.rhtml
index 93bed72b083ff8be308ee191b754479708032179..a96fd5b1917c4a24dcc5a9f1f287a0b46c64ec52 100644 (file)
--- a/app/views/user/view.rhtml
+++ b/app/views/user/view.rhtml
@@ -38,7 +38,7 @@
       <% @friend = User.find_by_id(friend.friend_user_id) %>
       <tr>
       <td class="username"><%= link_to @friend.display_name, :controller => 'user', :action => 'view',  :display_name => @friend.display_name %></td>
       <% @friend = User.find_by_id(friend.friend_user_id) %>
       <tr>
       <td class="username"><%= link_to @friend.display_name, :controller => 'user', :action => 'view',  :display_name => @friend.display_name %></td>

-      <td><%= @this_user.distance(@friend).round %>km away</td>
+      <td><% if @friend.home_lon and @friend.home_lat %><%= @this_user.distance(@friend).round %>km away<% end %></td>

       <td class="message">(<%= link_to 'send message', :controller => 'message', :action => 'new', :user_id => @friend.id %>)</td>
       </tr>
       <%end%>
       <td class="message">(<%= link_to 'send message', :controller => 'message', :action => 'new', :user_id => @friend.id %>)</td>
       </tr>
       <%end%>