Escape user display names.

[rails.git] / app / views / message / new.rhtml

diff --git a/app/views/message/new.rhtml b/app/views/message/new.rhtml
index 6e268e905b1f6d42b7761a431bde9ce8838ba521..d66e7caedb8773d0aa4134cd812d27e8228f8603 100644 (file)
--- a/app/views/message/new.rhtml
+++ b/app/views/message/new.rhtml
@@ -1,20 +1,32 @@
-<% display_name = (User.find_by_id(params[:user_id])).display_name %>
+<% display_name = User.find_by_id(params[:user_id]).display_name %>
+<% title = params[:message] ? params[:message][:title] : params[:title] %>
 
-<h2>Send a new message to <%= display_name %></h2>
+<h2>Send a new message to <%= h(display_name) %></h2>
 
 <% if params[:display_name] %>
-<p>Writing a new message to <%= params[:display_name] %></p>  
+<p>Writing a new message to <%= h(params[:display_name]) %></p>  
 <p>TODO: drop down box of your friends</p>
 <%end%>
 
 <%= error_messages_for 'message' %>
 
-<% form_tag :controller => 'message', :action => 'new' do %>
-subject: <%= text_field 'message', 'title' %><br>
-body: <%= text_area 'message', 'body' %><br>
-  <%= submit_tag 'Send' %>
+<% form_for :message do |f| %>
+  <table>
+    <tr valign="top">
+      <th>Subject</th>
+      <td><%= text_field_tag 'message[title]', title, :size => 60 %></td>
+    </tr>
+    <tr valign="top">
+      <th>Body</th>
+      <td><%= f.text_area :body, :cols => 80 %></td>
+    </tr>
+    <tr>
+      <th></th>
+      <td><%= submit_tag 'Send' %></td>
+    </tr>
+  </table>
 <% end %>
 
 <br />
 
-<%= link_to 'Back to my account', :controller => 'user', :action => 'account' %>
+<%= link_to 'Back to inbox', :controller => 'message', :action => 'inbox', :display_name => @user.display_name %>