Merged from jdong; lots of escaping fixes

[selectricity-live] / app / controllers / quickvote_controller.rb

diff --git a/app/controllers/quickvote_controller.rb b/app/controllers/quickvote_controller.rb
index 58370f7096b8b3b2ba1e0057553087ca2cc3e378..bb60b4552b029efff74be54bba9282c7599a671f 100644 (file)
--- a/app/controllers/quickvote_controller.rb
+++ b/app/controllers/quickvote_controller.rb
@@ -14,14 +14,13 @@ class QuickvoteController < ApplicationController
       @quickvote = QuickVote.new(params[:quickvote])
       # store the candidate grabbed through ajax and stored in flash
       @quickvote.candidatelist = flash[:candlist]
       @quickvote = QuickVote.new(params[:quickvote])
       # store the candidate grabbed through ajax and stored in flash
       @quickvote.candidatelist = flash[:candlist]

-      @quickvote.description=CGI.escapeHTML(@quickvote.description)
+      @quickvote.description=@quickvote.description

       # try to save, if it fails, show the page again (the flash should
       # still be intact
       if @quickvote.save
         @quickvote = @quickvote.reload
         render :action => 'success'
       else
       # try to save, if it fails, show the page again (the flash should
       # still be intact
       if @quickvote.save
         @quickvote = @quickvote.reload
         render :action => 'success'
       else

-        raise ArgumentError.new(@quickvote.errors.inspect)

         flash.keep(:candlist)
       end 
 
         flash.keep(:candlist)
       end 
 


@@ -34,7 +33,7 @@ class QuickvoteController < ApplicationController
   end
 
   def add_candidate
   end
 
   def add_candidate

-    candidate_name = CGI.escapeHTML(params[:ajax][:newcandidate])
+    candidate_name = params[:ajax][:newcandidate]

     unless candidate_name.strip.empty?
       if flash.has_key?(:candlist) and flash[:candlist].instance_of?(Array) 
         flash[:candlist] << candidate_name unless flash[:candlist].index(candidate_name)
     unless candidate_name.strip.empty?
       if flash.has_key?(:candlist) and flash[:candlist].instance_of?(Array) 
         flash[:candlist] << candidate_name unless flash[:candlist].index(candidate_name)


@@ -157,7 +156,11 @@ class QuickvoteController < ApplicationController
   ###############################################################
 
   def results
   ###############################################################
 
   def results

-    @election = QuickVote.ident_to_quickvote(params[:ident])
+    unless @election = QuickVote.ident_to_quickvote(params[:ident])
+      flash[:notice] = "Cannot find quickvote #{params[:ident]}."
+      redirect_to :controller => 'site'
+      return
+    end

     @election.results
     @candidates = {}
     @election.candidates.each {|c| @candidates[c.id] = c}
     @election.results
     @candidates = {}
     @election.candidates.each {|c| @candidates[c.id] = c}