fix security issue

[selectricity-live] / app / views / election / _candidate_line.rhtml

diff --git a/app/views/election/_candidate_line.rhtml b/app/views/election/_candidate_line.rhtml
index e5bcf07b22b22275675f00fa799d1857042c7d68..2fc9a6353728e61e6cf421ee2949b510d62369f9 100644 (file)
--- a/app/views/election/_candidate_line.rhtml
+++ b/app/views/election/_candidate_line.rhtml
@@ -1,19 +1,17 @@
 <div id="cand<%= @current_candidate.id %>">
   <li><%=h @current_candidate.name -%>
-    <% if @show_details %>
-      (<%= link_to_remote "Hide Details",
-                         :update => "cand#{@current_candidate.id}",
-                         :url => { :action => :lessinfo_candidate,
-                                      :id => @current_candidate.id } %>)
-      <br />
-      <blockquote>
-      <%=h (@current_candidate.description) %>
-      </blockquote>
-    <% else %>
-      (<%= link_to_remote "Show Details",
-                         :update => "cand#{@current_candidate.id}",
-                         :url => { :action => :moreinfo_candidate,
-                                              :id => @current_candidate.id } %>)
-    <% end %>
+    <span id="show_candidate_link_<%= @current_candidate.id %>">
+    (<%= link_to "Show Details", "#",
+         :onclick => "show_candidate_info(#{@current_candidate.id}); return false;"  %>)
+    </span>
+    <span style="display: none;" id="hide_candidate_link_<%= @current_candidate.id %>">
+    (<%= link_to "Hide Details", "#",
+         :onclick => "hide_candidate_info(#{@current_candidate.id}); return false;" %>)
+    <br />
+
+    <div style="display: none;" id="candidate_description_<%= @current_candidate.id %>">
+    <%= render :partial => 'candidate_box_info' %>
+    </>
+    </span>
   </li>
 </div>