Do some HTML escaping on election and candidate names

[selectricity-live] / app / views / election / edit.rhtml

diff --git a/app/views/election/edit.rhtml b/app/views/election/edit.rhtml
index 968d1575124c730204089cc2a17e7b5ef094f280..40aaad28d51b510674231ae236a77959967600ed 100644 (file)
--- a/app/views/election/edit.rhtml
+++ b/app/views/election/edit.rhtml
@@ -1,4 +1,4 @@
-<h1><strong><%= @election.name %>:</strong> Edit Overview</h1>
+<h1><strong><%=h @election.name %>:</strong> Edit Overview</h1>
 
 <% form_tag(:action => 'update', :id => @election) do %>
   <%= render :partial => 'overview_form' %>