Escape user display names.

diff --git a/app/views/message/_message_summary.rhtml b/app/views/message/_message_summary.rhtml
index 381a6cce1d6ea2d4d7a135af4bd38b887ccc8594..6d45d33dd33f0eefca339ad37039ea59d35c9b2f 100644 (file)
--- a/app/views/message/_message_summary.rhtml
+++ b/app/views/message/_message_summary.rhtml
@@ -1,8 +1,8 @@
 <% this_colour = cycle('lightgrey', 'white') # can only call once for some dumb reason %>
 
 <tr class="inbox-row<%= "-unread" if not message_summary.message_read? %>">
-  <td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to message_summary.sender.display_name , :controller => 'user', :action => message_summary.sender.display_name %></td>
-  <td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to  h(message_summary.title) , :controller => 'message', :action => 'read', :message_id => message_summary.id  %></td>
+  <td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to h(message_summary.sender.display_name), :controller => 'user', :action => message_summary.sender.display_name %></td>
+  <td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to h(message_summary.title), :controller => 'message', :action => 'read', :message_id => message_summary.id  %></td>
   <td class="inbox-sent" bgcolor='<%= this_colour %>'><%= message_summary.sent_on %></td>
   <% if message_summary.message_read? %>
     <td><%= button_to 'Mark as unread', :controller => 'message', :action => 'mark', :message_id => message_summary.id, :mark => 'unread' %></td>

diff --git a/app/views/message/_sent_message_summary.rhtml b/app/views/message/_sent_message_summary.rhtml
index 9c117bdd62bbfa66370743d0b94824cd1d605aa1..f0d87aa27c98f16f348a88dd2b90ccf8f0abb451 100644 (file)
--- a/app/views/message/_sent_message_summary.rhtml
+++ b/app/views/message/_sent_message_summary.rhtml
@@ -1,7 +1,7 @@
 <% this_colour = cycle('lightgrey', 'white') # can only call once for some dumb reason %>
 
 <tr class="inbox-row">
-  <td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to sent_message_summary.recipient.display_name , :controller => 'user', :action => sent_message_summary.recipient.display_name %></td>
-  <td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to  h(sent_message_summary.title) , :controller => 'message', :action => 'read', :message_id => sent_message_summary.id  %></td>
- <td class="inbox-sent" bgcolor='<%= this_colour %>'><%= sent_message_summary.sent_on %></td>
+  <td class="inbox-sender" bgcolor='<%= this_colour %>'><%= link_to h(sent_message_summary.recipient.display_name), :controller => 'user', :action => sent_message_summary.recipient.display_name %></td>
+  <td class="inbox-subject" bgcolor='<%= this_colour %>'><%= link_to h(sent_message_summary.title), :controller => 'message', :action => 'read', :message_id => sent_message_summary.id  %></td>
+  <td class="inbox-sent" bgcolor='<%= this_colour %>'><%= sent_message_summary.sent_on %></td>
 </tr>

diff --git a/app/views/message/new.rhtml b/app/views/message/new.rhtml
index 84b3bfdc880f030a877cce5ccc0164c73637f96a..d66e7caedb8773d0aa4134cd812d27e8228f8603 100644 (file)
--- a/app/views/message/new.rhtml
+++ b/app/views/message/new.rhtml
@@ -1,7 +1,7 @@
 <% display_name = User.find_by_id(params[:user_id]).display_name %>
 <% title = params[:message] ? params[:message][:title] : params[:title] %>
 
-<h2>Send a new message to <%= display_name %></h2>
+<h2>Send a new message to <%= h(display_name) %></h2>
 
 <% if params[:display_name] %>
 <p>Writing a new message to <%= h(params[:display_name]) %></p>  

diff --git a/app/views/message/read.rhtml b/app/views/message/read.rhtml
index 58a77ad4631e7a32e286598b2e963262a8c46b59..d44859029dea35f7cadda8002239b8120943d419 100644 (file)
--- a/app/views/message/read.rhtml
+++ b/app/views/message/read.rhtml
@@ -10,7 +10,7 @@
         <%= image_tag url_for_file_column(@message.sender, "image") %>
       <% end %>
   
-<%= link_to @message.sender.display_name, :controller => 'user', :action => 'view', :display_name => @message.sender.display_name %></td>
+<%= link_to h(@message.sender.display_name), :controller => 'user', :action => 'view', :display_name => @message.sender.display_name %></td>
   </tr>
   <tr>
     <th align="right">Subject</th>
@@ -43,7 +43,7 @@
 <table>
   <tr>
     <th align="right">To</th>
-    <td><%= link_to @message.recipient.display_name, :controller => 'user', :action => 'view', :display_name => @message.recipient.display_name %></td>
+    <td><%= link_to h(@message.recipient.display_name), :controller => 'user', :action => 'view', :display_name => @message.recipient.display_name %></td>
   </tr>
   <tr>
     <th align="right">Subject</th>