Close a number of holes in the API by making it validate changes

[rails.git] / app / views / user / account.rhtml

diff --git a/app/views/user/account.rhtml b/app/views/user/account.rhtml
index bbede9fed139ad653f9cf034c3ca3319634a1e15..ca1fe61bd81df56625b42a4aaa4ef306fdf8d7a4 100644 (file)
--- a/app/views/user/account.rhtml
+++ b/app/views/user/account.rhtml
@@ -1,10 +1,12 @@
 <h2>User details</h2>
 <%= error_messages_for 'user' %>
-<%= start_form_tag :controller => 'user', :action => 'edit', :display_name => @user.display_name %>
+<% form_tag :controller => 'user', :action => 'account', :display_name => @user.display_name do %>
 <table style="width : 100%">
   <tr><td>Name</td><td><%= @user.email %></td></tr>
   <tr><td>Mapper since</td><td><%= @user.creation_time %> (<%= time_ago_in_words(@user.creation_time) %> ago)</td></tr>
   <tr><td>Display Name</td><td><%= text_field :user, :display_name, :value => @user.display_name %></td></tr>
+  <tr><td>Password</td><td><%= password_field('user', 'pass_crypt',{:value => '', :size => 50, :maxlength => 255}) %></td></tr>
+  <tr><td>Confirm Password</td><td><%= password_field('user', 'pass_crypt_confirmation',{:value => '', :size => 50, :maxlength => 255}) %></td></tr>
   <tr id="homerow" <% unless @user.home_lat and @user.home_lon %> class="nohome" <%end%> ><td>Your home</td><td><em class="message">You have not entered your home location.</em><span class="location">Latitude: <%= text_field :user, :home_lat, :value => @user.home_lat, :size => 20, :id => "home_lat" %> Longitude <%= text_field :user, :home_lon, :value => @user.home_lon, :size => 20, :id => "home_lon" %></span>  </td></tr>
 
   <tr><td></td><td>
@@ -18,7 +20,7 @@
   <tr><td valign="top">Description</td><td><%= text_area :user, :description, :value => @user.description, :class => "editDescription" %></td></tr>
 </table>
 <%= submit_tag 'Save Changes' %>
-<%= end_form_tag %>
+<% end %>
 
 <% nearest_str = "" %>
 <% if @user.home_lat and @user.home_lon %>
@@ -213,7 +215,7 @@ window.onload = init;
 <% else %>
   Currently your edits are anonymous and people can't find out where you are located. To show what you edited and allow people to contact you through the website, click the button below. This action cannot be reversed.
   <br /><br />
-  <%= start_form_tag :controller => 'user', :action => 'go_public'%>
+  <% form_tag :controller => 'user', :action => 'go_public' do %>
   <%= submit_tag 'Make all my edits public, forever' %>
-  <%= end_form_tag %>
+  <% end %>
 <% end %>