Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity-live] / app / views / quickvote / _pref_table.rhtml

diff --git a/app/views/quickvote/_pref_table.rhtml b/app/views/quickvote/_pref_table.rhtml
index 32f5de4bc81254afef3a36fbae12a82ab331d21b..1d3cdf37b29706c7be45c654ccf05000be20caef 100644 (file)
--- a/app/views/quickvote/_pref_table.rhtml
+++ b/app/views/quickvote/_pref_table.rhtml
@@ -1,4 +1,6 @@
 <% candidates = @election.candidates.sort.collect {|candidate| candidate.id}-%>
+<% voters = @election.voters.size %>
+
 <% names = Hash.new -%>
 <% candidates.each do |candidate| -%>
        <%names[candidate] = Candidate.find(candidate).name -%>
@@ -7,16 +9,20 @@
   <tr>
        <td> </td>
        <% candidates.each do |candidate| -%>
-         <th><%= names[candidate] -%></th>
+         <th><%=h names[candidate] -%></th>
        <% end -%>
 <% candidates.each do |winner| -%>
   <tr>
-       <th><%= names[winner] %></th>
+       <th><%=h names[winner] %></th>
   <% candidates.each do |loser| -%> 
     <% if winner == loser -%>
       <td> -- </td>
     <% else %>         
-      <td><%= @election.condorcet_result.matrix[winner][loser] %></td>
+      <td><% wins = @election.condorcet_result.matrix[winner][loser]%>
+          <%=h wins %>
+             <%= sparkline_tag [(wins.to_f/voters.to_f)*100.0], :type => 'pie', 
+                                :diameter => 25, :share_color => '#74ce00' %>
+         </td>
     <% end -%>
   <% end -%>
  </tr>