fix security issue

[selectricity-live] / app / views / voter / review.rhtml

diff --git a/app/views/voter/review.rhtml b/app/views/voter/review.rhtml
index b8b9089f2775500478d97e8baaa17f7923d2539f..a72ecda7b2a18d70f5d57bf1c47c015bae428d74 100644 (file)
--- a/app/views/voter/review.rhtml
+++ b/app/views/voter/review.rhtml
@@ -1,7 +1,11 @@
-<% %>
+<div id="title-header">
+  <span class="header">Review</span>
+  <span class="subheader"><%= @voter.election.name %></span>
+</div>
 
-<% %>
-<h1>Please review your vote carefully before confirming it.</h1>
+<p><strong>Your vote will not be recorded until you confirm it on this
+page.</strong> Please review your vote carefully before clicking 
+confirm.</p>
 
 <p>You have ranked the candidates in the following order (from most
 preferred to least preferred:</p>
@@ -12,21 +16,36 @@ preferred to least preferred:</p>
   <% end %>
 </ol>
 
-<table>
-<tr>
-  <td valign="top"><%= button_to 'Confirm', :action => 'confirm', :id => @voter.password %></td>
-  <td valign="top">Confirm this vote now. You will be able to go back and
-    change it.</td>
-</tr>
+<div class="normal-header">
+  <span class="header">Confirm/Discard</span>
+  <span class="subheader"></span>
+</div>
 
-<tr>
-  <td valign="top"><%= button_to 'Change', :action => 'index', :id => @voter.password %></td>
-  <td valign="top">Go back to the voting page and vote again.</td>
-</tr>
+<p>Please select from one of the following pages.</p>
 
-<tr>
-  <td valign="top"><%= button_to 'Discard', :action => 'discard' %></td>
-  <td valign="top">Discard this tentative vote and log out.</td>
-</tr>
+<div style="text-align: center;">
+  <p><% if @voter.election.kiosk? and params[:kiosk] == 'true' %>
+        <%= button_to 'Confirm This Vote', :action => 'confirm', :id => @password,
+                      :kiosk => true %>
+      <% else %>
+        <%= button_to 'Confirm This Vote', :action => 'confirm', :id => @password %>
+      <% end %>
+  </p>
 
-</table>
+  <% unless @voter.election.kiosk? %>
+    <p>If you choose, you will be able to go back<br />and change it up until
+    the end of the voting period.</p>
+  <% end %>
+  
+  <p><% if @voter.election.kiosk? and params[:kiosk] == 'true' %>
+        <%= button_to 'Discard This Vote', 
+            votepassword_url(:action => 'index', :urlpassword => @password,
+                             :kiosk => true) %>
+      <% else %>
+        <%= button_to 'Discard This Vote', 
+            votepassword_url(:action => 'index', :urlpassword => @password) %>
+      <% end %>
+    </p>
+    
+</tr>
+</div>