Add a few more escape calls to prevent nasty HTML being rendered. Also

[rails.git] / app / views / message / read.rhtml

diff --git a/app/views/message/read.rhtml b/app/views/message/read.rhtml
index 1e2a3bf5b27405e889e061e93e1d84d6897b7d9a..b3dcd1f23a84d3fb562c7603bef3b444e73f22bf 100644 (file)
--- a/app/views/message/read.rhtml
+++ b/app/views/message/read.rhtml
@@ -1,16 +1,65 @@
+<% if @user == @message.recipient %>
+
 <h2>Reading your messages</h2>
 
 <table>
-<th>from</th>
-<th>message</th>
-<th>date</th>
-<th>reply</th>
-<tr><td><%= (User.find_by_id(@message.from_user_id)).display_name %></td>
-<td><%= @message.body %></td>
-<td><%= @message.sent_on %></td>
-<td><%= link_to 'reply', :controller => 'message', :action => 'new', :user_id => @message.from_user_id %></td>
+  <tr>
+    <th align="right">From</th>
+    <td><%= link_to @message.sender.display_name, :controller => 'user', :action => 'view', :display_name => @message.sender.display_name %></td>
+  </tr>
+  <tr>
+    <th align="right">Subject</th>
+    <td><%= h(@message.title) %></td>
+  </tr>
+  <tr>
+    <th align="right">Date</th>
+    <td><%= @message.sent_on %></td>
+  </tr>
+  <tr>
+    <th></th>
+    <td><%= sanitize(@message.body) %></td>
+  </tr>
 </table>
 
-<%= start_form_tag :controller => 'message', :action => 'mark', :message_id => @message.id %>
-<%= submit_tag 'Mark as read' %>
+<br />
+
+<table>
+  <tr>
+    <td><%= button_to 'Reply', :controller => 'message', :action => 'new', :user_id => @message.from_user_id %></td>
+    <td><%= button_to 'Mark as unread', :controller => 'message', :action => 'mark', :message_id => @message.id, :mark => 'unread' %></td>
+    <td><%= link_to 'Back to inbox', :controller => 'message', :action => 'inbox', :display_name => @user.display_name %></td>
+  </tr>
+</table>
+
+<% else %>
+
+<h2>Reading your sent messages</h2>
+
+<table>
+  <tr>
+    <th align="right">To</th>
+    <td><%= link_to @message.recipient.display_name, :controller => 'user', :action => 'view', :display_name => @message.recipient.display_name %></td>
+  </tr>
+  <tr>
+    <th align="right">Subject</th>
+    <td><%= h(@message.title) %></td>
+  </tr>
+  <tr>
+    <th align="right">Date</th>
+    <td><%= @message.sent_on %></td>
+  </tr>
+  <tr>
+    <th></th>
+    <td><%= sanitize(@message.body) %></td>
+  </tr>
+</table>
+
+<br />
+
+<table>
+  <tr>
+    <td><%= link_to 'Back to outbox', :controller => 'message', :action => 'outbox', :display_name => @user.display_name %></td>
+  </tr>
+</table>
 
+<% end %>