fix security issue

[selectricity-live] / app / views / common / _pref_tables.rhtml

diff --git a/app/views/common/_pref_tables.rhtml b/app/views/common/_pref_tables.rhtml
index 7701985ec49b5e5a3c7a1ce965c410242e046c75..3a53144068b601556d16b79f12d516fed90535ea 100644 (file)
--- a/app/views/common/_pref_tables.rhtml
+++ b/app/views/common/_pref_tables.rhtml
@@ -2,7 +2,6 @@
 <% voters = @election.voters.size %>
 <% matrix = @election.ssd_result.matrix %>
 <% victories = @election.ssd_result.victories_and_ties %>
 <% voters = @election.voters.size %>
 <% matrix = @election.ssd_result.matrix %>
 <% victories = @election.ssd_result.victories_and_ties %>

-

 <p>Each number in the table below shows how many times the candidate on
 the left beat the matching candidate on the top. The winner is on the
 top of the left column.</p>
 <p>Each number in the table below shows how many times the candidate on
 the left beat the matching candidate on the top. The winner is on the
 top of the left column.</p>


@@ -14,13 +13,13 @@ top of the left column.</p>
   <tr>
        <td></td>
        <% candidates.each do |candidate| -%>
   <tr>
        <td></td>
        <% candidates.each do |candidate| -%>

-         <th><%=h @names[candidate] -%></th>
+         <th><%= white_list(@names[candidate]) -%></th>

   <% end -%>
  </tr>
 
 <% candidates.each do |winner| -%>
   <tr>
   <% end -%>
  </tr>
 
 <% candidates.each do |winner| -%>
   <tr>

-       <th><%=h @names[winner] %></th>
+       <th><%= white_list(@names[winner]) %></th>

   <% candidates.each do |loser| -%> 
     <% if winner == loser -%>
       <td> -- </td>
   <% candidates.each do |loser| -%> 
     <% if winner == loser -%>
       <td> -- </td>


@@ -46,14 +45,17 @@ parenthesis.</p>
 <table class="preftable">
   <% candidates.each do |victor| %>
   <tr>
 <table class="preftable">
   <% candidates.each do |victor| %>
   <tr>

-    <th><%=h @names[victor] %></th>
-       <% victories[victor].keys.each do |loser| %>
-       <% margin = victories[victor][loser]%>
-       <td><%=h @names[loser] %> 
-           <% if margin == 0%>
+    <th><%= white_list(@names[victor]) %></th>
+<!-- This is a pretty logic heavy section - think about trying to move it to 
+       backend eventually. Change the order of first and second to change the order 
+       that things are sorted in. -->
+       <% sorted = victories[victor].sort { |first,second| first[1] <=> second[1] }%>
+       <% sorted.each do |loserpair| %>
+       <td><%= white_list(@names[loserpair[0]]) %> 
+           <% if loserpair[1] == 0%>

                  Tied!
                <% else -%>
                  Tied!
                <% else -%>

-                 (<%= margin%>)
+                 (<%= loserpair[1] %>)

                <% end -%>
        </td>
        <% end -%>
                <% end -%>
        </td>
        <% end -%>


@@ -62,3 +64,4 @@ parenthesis.</p>
 </table>
 </div>
 
 </table>
 </div>
 

+