HTML escape description to prevent code injection onto page

[selectricity-live] / app / models / candidate.rb

diff --git a/app/models/candidate.rb b/app/models/candidate.rb
index 7b6e8024a52bb30bfa1dbb57f80167426cf51502..430b6ab22762223a728eaf6cc27bb3d51f7b8d2e 100644 (file)
--- a/app/models/candidate.rb
+++ b/app/models/candidate.rb
@@ -1,8 +1,9 @@
 class Candidate < ActiveRecord::Base
   belongs_to :election
-  validates_uniqueness_of :name
   validates_presence_of :name
 
+  # validate uniqueness of a name *within a given election*
+
   def <=>(other)
     self.name <=> other.name 
   end