Sanitise parameters used in URL generation

[rails.git] / app / views / diary_entry / view.html.erb

diff --git a/app/views/diary_entry/view.html.erb b/app/views/diary_entry/view.html.erb
index 451d849c2d847e67576e95facdd603ad1af85794..6a2a21abcba3bf26b0b341a5dd1fb4019501af57 100644 (file)
--- a/app/views/diary_entry/view.html.erb
+++ b/app/views/diary_entry/view.html.erb
@@ -1,28 +1,37 @@
-<div id="diary_entry">
-  <%= user_image @entry.user %>
-
-  <h2><%= link_to t('diary_entry.view.user_title', :user => h(@entry.user.display_name)), :action => :list %></h2>
-
-  <%= render :partial => 'diary_entry', :object => @entry %>
-
-  <a id="comments"></a>
-
-  <%= render :partial => 'diary_comment', :collection => @entry.visible_comments %>
-
-  <% if_logged_in(:div) do %>
-    <h4 id="newcomment"><%= t 'diary_entry.view.leave_a_comment' %></h4>
+<% content_for :heading do %>
+  <div id="userinformation" >
+    <%= user_image @entry.user %>
+    <h2><%= link_to t('diary_entry.view.user_title', :user => h(@entry.user.display_name)), :action => :list %></h2>
+    <p><%= rss_link_to :action => :rss, :display_name => @entry.user.display_name %></p>
+  </div>
+<% end %>
+
+<%= render :partial => 'diary_entry', :object => @entry %>
+
+<a id="comments"></a>
+<div class='comments'>
+<%= render :partial => 'diary_comment', :collection => @entry.visible_comments %>
+</div>
+<%= if_logged_in(:div) do %>
+  <h3 id="newcomment"><%= t 'diary_entry.view.leave_a_comment' %></h3>
 
-    <%= error_messages_for 'diary_comment' %>
+  <%= error_messages_for 'diary_comment' %>
 
-    <% form_for :diary_comment, @diary_comment, :url => { :action => 'comment' } do |f| %>
-      <%= f.text_area :body, :cols => 80, :rows => 5 %>
-      <br />
-      <br />
-      <%= submit_tag t('diary_entry.view.save_button') %>
-    <% end %>
+  <%= form_for :diary_comment, :url => { :action => 'comment' } do |f| %>
+    <%= richtext_area :diary_comment, :body, :cols => 80, :rows => 15 %>
+    <%= submit_tag t('diary_entry.view.save_button') %>
   <% end %>
-
-  <% if_not_logged_in(:div) do %>
-    <h4 id="newcomment"><%= t("diary_entry.view.login_to_leave_a_comment", :login_link => link_to(t("diary_entry.view.login"), :controller => 'user', :action => 'login', :referer => request.request_uri)) %></h4>
+  <% if @user and @entry.subscribers.exists?(@user.id) %>
+    <div class="diary-subscribe-buttons"><%= link_to t('javascripts.changesets.show.unsubscribe'), diary_entry_unsubscribe_path(:display_name => @entry.user.display_name, :id => @entry.id), :method => :post, :class => :button %></div>
+  <% elsif @user %>
+    <div class="diary-subscribe-buttons"><%= link_to t('javascripts.changesets.show.subscribe'), diary_entry_subscribe_path(:display_name => @entry.user.display_name, :id => @entry.id), :method => :post, :class => :button %></div>
   <% end %>
-</div>
+<% end %>
+
+<%= if_not_logged_in(:div) do %>
+  <h3 id="newcomment"><%= raw t("diary_entry.view.login_to_leave_a_comment", :login_link => link_to(t("diary_entry.view.login"), :controller => 'user', :action => 'login', :referer => request.fullpath)) %></h3>
+<% end %>
+
+<% content_for :auto_discovery_link_tag do -%>
+<%= auto_discovery_link_tag :rss, :action => :rss, :display_name => @entry.user.display_name %>
+<% end -%>