patched controller section of #648

[rails.git] / app / views / message / read.rhtml

diff --git a/app/views/message/read.rhtml b/app/views/message/read.rhtml
index 4117057d006388f48ec7a7e94de19007df541216..7c010b9d5e90ebbfb23ed0c69fc9fb9a2b5ed1dc 100644 (file)
--- a/app/views/message/read.rhtml
+++ b/app/views/message/read.rhtml
@@ -9,7 +9,7 @@
   </tr>
   <tr>
     <th align="right">Subject</th>
   </tr>
   <tr>
     <th align="right">Subject</th>

-    <td><%= @message.title %></td>
+    <td><%= h(@message.title) %></td>

   </tr>
   <tr>
     <th align="right">Date</th>
   </tr>
   <tr>
     <th align="right">Date</th>


@@ -17,7 +17,7 @@
   </tr>
   <tr>
     <th></th>
   </tr>
   <tr>
     <th></th>

-    <td><%= @message.body %></td>
+    <td><%= htmlize(@message.body) %></td>

   </tr>
 </table>
 
   </tr>
 </table>
 


@@ -25,7 +25,7 @@
 
 <table>
   <tr>
 
 <table>
   <tr>

-    <td><%= button_to 'Reply', :controller => 'message', :action => 'new', :user_id => @message.from_user_id %></td>
+    <td><%= button_to 'Reply', :controller => 'message', :action => 'reply', :message_id => @message.id %></td>

     <td><%= button_to 'Mark as unread', :controller => 'message', :action => 'mark', :message_id => @message.id, :mark => 'unread' %></td>
     <td><%= link_to 'Back to inbox', :controller => 'message', :action => 'inbox', :display_name => @user.display_name %></td>
   </tr>
     <td><%= button_to 'Mark as unread', :controller => 'message', :action => 'mark', :message_id => @message.id, :mark => 'unread' %></td>
     <td><%= link_to 'Back to inbox', :controller => 'message', :action => 'inbox', :display_name => @user.display_name %></td>
   </tr>


@@ -42,7 +42,7 @@
   </tr>
   <tr>
     <th align="right">Subject</th>
   </tr>
   <tr>
     <th align="right">Subject</th>

-    <td><%= @message.title %></td>
+    <td><%= h(@message.title) %></td>

   </tr>
   <tr>
     <th align="right">Date</th>
   </tr>
   <tr>
     <th align="right">Date</th>


@@ -50,7 +50,7 @@
   </tr>
   <tr>
     <th></th>
   </tr>
   <tr>
     <th></th>

-    <td><%= @message.body %></td>
+    <td><%= htmlize(@message.body) %></td>

   </tr>
 </table>
 
   </tr>
 </table>