Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity-live] / app / views / quickvote / _candidate_list.rhtml

diff --git a/app/views/quickvote/_candidate_list.rhtml b/app/views/quickvote/_candidate_list.rhtml
index 5c76d62d8c3bd380cf39b254c0b423109270fc4f..ddb47e53fa7f6a49b707bcecdb530e5ef0dd1a54 100644 (file)
--- a/app/views/quickvote/_candidate_list.rhtml
+++ b/app/views/quickvote/_candidate_list.rhtml
@@ -1,17 +1,18 @@
 <% %>
 <!-- the list of candidates -->
-<% if @flash[:candlist] %>
+<% if flash[:candlist] %>
   <ul>
-  <% for cand in @flash[:candlist] %>
-    <li><%= cand.capitalize %></li>
+  <% for cand in flash[:candlist] %>
+    <li><%=h cand.capitalize %></li>
   <% end %>
   </ul>
 <% end %>
 
-<%= form_remote_tag :update => 'candlist',
-                    :url => { :action => 'add_candidate' } %>
+<% form_remote_tag(:update => 'candlist',
+                    :url => { :action => 'add_candidate' },
+                   :complete => "Field.focus('ajax_newcandidate')") do %>
 <p>
   <%= text_field "ajax", "newcandidate", :size => 40 %>
   <%= submit_tag "Add(+)" %>
 </p>
-<%= end_form_tag %>
+<% end %>