fix security issue

[selectricity-live] / app / views / voter / review.rhtml

diff --git a/app/views/voter/review.rhtml b/app/views/voter/review.rhtml
index b831aef225471db68e2181fd2c1b8a670bc202a5..a72ecda7b2a18d70f5d57bf1c47c015bae428d74 100644 (file)
--- a/app/views/voter/review.rhtml
+++ b/app/views/voter/review.rhtml
@@ -24,15 +24,28 @@ preferred to least preferred:</p>
 <p>Please select from one of the following pages.</p>
 
 <div style="text-align: center;">
 <p>Please select from one of the following pages.</p>
 
 <div style="text-align: center;">

-  <p><%= button_to 'Confirm This Vote', :action => 'confirm', :id => @password %></p>
-
-  <p>If you choose, you will be able to go back<br />and change it up until
-  the end of the voting period.</p>
+  <p><% if @voter.election.kiosk? and params[:kiosk] == 'true' %>
+        <%= button_to 'Confirm This Vote', :action => 'confirm', :id => @password,
+                      :kiosk => true %>
+      <% else %>
+        <%= button_to 'Confirm This Vote', :action => 'confirm', :id => @password %>
+      <% end %>
+  </p>
+
+  <% unless @voter.election.kiosk? %>
+    <p>If you choose, you will be able to go back<br />and change it up until
+    the end of the voting period.</p>
+  <% end %>

   
   

-  <p><%= button_to 'Discard This Vote', votepassword_url(
-                   :action => 'index', :urlpassword => @password) %></p>
-
-  <p>You will be returned to the voting page to vote<br /> again, if you choose.</p>
-
+  <p><% if @voter.election.kiosk? and params[:kiosk] == 'true' %>
+        <%= button_to 'Discard This Vote', 
+            votepassword_url(:action => 'index', :urlpassword => @password,
+                             :kiosk => true) %>
+      <% else %>
+        <%= button_to 'Discard This Vote', 
+            votepassword_url(:action => 'index', :urlpassword => @password) %>
+      <% end %>
+    </p>
+    

 </tr>
 </div>
 </tr>
 </div>