Fix the CrossSiteScripting warnings from Brakeman

[rails.git] / app / views / diary_entries / show.html.erb

diff --git a/app/views/diary_entries/show.html.erb b/app/views/diary_entries/show.html.erb
index cc761b15d3b03829997cd75a92d14a8238d804ae..d3a0f70b267a5cfbc409e896aed35ddb14448ad5 100644 (file)
--- a/app/views/diary_entries/show.html.erb
+++ b/app/views/diary_entries/show.html.erb
@@ -1,12 +1,12 @@
 <% content_for :heading do %>
   <div id="userinformation">
     <%= user_image @entry.user %>
 <% content_for :heading do %>
   <div id="userinformation">
     <%= user_image @entry.user %>

-    <h2><%= link_to t(".user_title", :user => h(@entry.user.display_name)), :action => :index %></h2>
+    <h2><%= link_to t(".user_title", :user => @entry.user.display_name), :action => :index %></h2>

     <p><%= rss_link_to :action => :rss, :display_name => @entry.user.display_name %></p>
   </div>
 <% end %>
 
     <p><%= rss_link_to :action => :rss, :display_name => @entry.user.display_name %></p>
   </div>
 <% end %>
 

-<%= render :partial => "diary_entry", :object => @entry %>
+<%= render @entry %>

 
 <a id="comments"></a>
 <div class='comments'>
 
 <a id="comments"></a>
 <div class='comments'>


@@ -29,7 +29,7 @@
       <div class="diary-subscribe-buttons"><%= link_to t("javascripts.changesets.show.subscribe"), diary_entry_subscribe_path(:display_name => @entry.user.display_name, :id => @entry.id), :method => :post, :class => :button %></div>
     <% end %>
   <% else %>
       <div class="diary-subscribe-buttons"><%= link_to t("javascripts.changesets.show.subscribe"), diary_entry_subscribe_path(:display_name => @entry.user.display_name, :id => @entry.id), :method => :post, :class => :button %></div>
     <% end %>
   <% else %>

-    <h3 id="newcomment"><%= raw t(".login_to_leave_a_comment", :login_link => link_to(t(".login"), :controller => "users", :action => "login", :referer => request.fullpath)) %></h3>
+    <h3 id="newcomment"><%= t(".login_to_leave_a_comment_html", :login_link => link_to(t(".login"), :controller => "users", :action => "login", :referer => request.fullpath)) %></h3>

   <% end %>
 </div>
 
   <% end %>
 </div>