fix security issue

[selectricity-live] / app / views / common / _methodinfo_ssd.rhtml

diff --git a/app/views/common/_methodinfo_ssd.rhtml b/app/views/common/_methodinfo_ssd.rhtml
index 6b6d42f13327e6fb589366ec5bdc42d1877717a7..5c01987c562b4dbe49837d981e8e4cd209fb5098 100644 (file)
--- a/app/views/common/_methodinfo_ssd.rhtml
+++ b/app/views/common/_methodinfo_ssd.rhtml
@@ -3,7 +3,7 @@ preference (from most preferred to least preferred):</p>
 
 <ol>
 <% @election.ssd_result.ranked_candidates.each do |place|  %>
-  <li><%= h(place.collect {|c| @names[c].capitalize}.join( " and " )) %>
+  <li><%= white_list place.collect {|c| @names[c].capitalize}.join( " <em>and</em> " ) %>
       <%= "<strong>(TIE)</strong>" if place.length > 1 %></li>
 <% end %>
 </ol>
@@ -25,12 +25,16 @@ Beatpath Winner, Path Voting, and Path Winner.</p>
 
 <% candidates = @election.ssd_result.ranked_candidates.flatten -%>
 <% if candidates.size <= 7 -%>
-  <%= render_partial 'common/pref_tables' %>
+  <%= render :partial => 'common/pref_tables' %>
 <% else %>
 
   There are too many candidates in your elections to show the result
-  tables.  <%= link_to "Click here", { :action => 'pref_tables', :id =>
-  @voter.password }, :popup => [] %> to view details.
+  tables.
+
+  <% if not @election.class == QuickVote %>
+    <%= link_to "Click here", { :action => 'pref_tables', :id => @election.id }, :popup => [] %>
+    to view details.
+  <% end %>
 
 <% end -%>