Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity-live] / app / views / quickvote / _pref_table.rhtml

diff --git a/app/views/quickvote/_pref_table.rhtml b/app/views/quickvote/_pref_table.rhtml
index dfcb6cca9ea31438ad480ce56b8814761743b1b8..1d3cdf37b29706c7be45c654ccf05000be20caef 100644 (file)
--- a/app/views/quickvote/_pref_table.rhtml
+++ b/app/views/quickvote/_pref_table.rhtml
@@ -1,19 +1,30 @@
-<% candidates = @election.candidates.sort.collect {|candidate| candidate.id} -%>
+<% candidates = @election.candidates.sort.collect {|candidate| candidate.id}-%>
+<% voters = @election.voters.size %>
+
+<% names = Hash.new -%>
+<% candidates.each do |candidate| -%>
+       <%names[candidate] = Candidate.find(candidate).name -%>
+<% end -%>
 <table class="voterbox">
   <tr>
        <td> </td>
        <% candidates.each do |candidate| -%>
-         <th><%= candidate -%></th>
+         <th><%=h names[candidate] -%></th>
        <% end -%>
 <% candidates.each do |winner| -%>
   <tr>
-       <th><%= winner %></th>
+       <th><%=h names[winner] %></th>
   <% candidates.each do |loser| -%> 
     <% if winner == loser -%>
       <td> -- </td>
     <% else %>         
-      <td><%= @election.condorcet_result.matrix[winner][loser] %></td>
+      <td><% wins = @election.condorcet_result.matrix[winner][loser]%>
+          <%=h wins %>
+             <%= sparkline_tag [(wins.to_f/voters.to_f)*100.0], :type => 'pie', 
+                                :diameter => 25, :share_color => '#74ce00' %>
+         </td>
     <% end -%>
   <% end -%>
  </tr>
-<%end -%>
\ No newline at end of file
+<% end -%>
+