Do some HTML escaping on election and candidate names

[selectricity-live] / app / views / election / _candidate_line.rhtml

diff --git a/app/views/election/_candidate_line.rhtml b/app/views/election/_candidate_line.rhtml
index 5145b88878e78add5767e0890644ac76b94cbaad..870a2de03d6bb977c9776abd745f7bd66c671d2a 100644 (file)
--- a/app/views/election/_candidate_line.rhtml
+++ b/app/views/election/_candidate_line.rhtml
@@ -1,6 +1,6 @@
 <% -%>
 <div id="cand<%= @current_candidate.id %>">
-  <li><%= @current_candidate.name -%>
+  <li><%=h @current_candidate.name -%>
     <% if @show_details %>
       (<%= link_to_remote "Hide Details",
                          :update => "cand#{@current_candidate.id}",