fix security issue

[selectricity-live] / app / views / election / edit_candidates.rhtml

diff --git a/app/views/election/edit_candidates.rhtml b/app/views/election/edit_candidates.rhtml
index dbcc3f8bad3b49a550c4c5159195bdf3542c17e8..cd0bd5ab7c99b5b05174677ddde9d0d36b26aff9 100644 (file)
--- a/app/views/election/edit_candidates.rhtml
+++ b/app/views/election/edit_candidates.rhtml
@@ -1,10 +1,33 @@
-<h1><strong><%= @election.name %>:</strong> Edit/Add Candidates</h1>
+<div id="title-header">
+  <span class="header">Edit Candidates</span>
+  <span class="subheader"></span>
+</div>
+
+<div class="clear-div"></div>
+
+<% if @election.active == 0 %>
+
+<div class="normal-header">
+  <span class="header">Enter New Candidate</span>
+  <span class="subheader"></span>
+</div>
 
 <%= error_messages_for :candidate %>
 
-<% unless @election.candidates.empty? %>
-  <p>The following are valid options or candidates in this election:</p>
+<% form_tag( { :action => :add_candidate, :id => @election.id },
+              :multipart => true ) do %>
+<%= render :partial => 'candidate_form' %>
+<p><%= submit_tag "Add Candidate" %></p>
+<% end %>
+
+
+<div class="normal-header">
+  <span class="header">Current Candidates</span>
+  <span class="subheader"></span>
+</div>
 
+
+<% unless @election.candidates.empty? %>
   <% @election.candidates.each do |candidate| %>
     <% @current_candidate = candidate %>
     <%= render :partial => 'candidate_line_edit' %>
@@ -14,12 +37,20 @@
   <p>There are no candidates registered for this election.</p>
 <% end %>
 
-<p>Please enter new candidates below.</p>
+<div class="normal-header">
+  <span class="header">Continue</span>
+  <span class="subheader"></span>
+</div>
 
-<%= form_tag( { :action => :add_candidate, :id => @election.id },
-              :multipart => true ) %>
-<%= render :partial => 'candidate_form' %>
-<%= submit_tag "Add Candidate" %>
-<%= end_form_tag %>
+<p>When you are done entering candidates, please click the button below
+to proceed to the next step.</p>
+
+<%= button_to "Proceed to Next Step", :action => 'new_voters', :id => @election %>
 
-<%= button_to "Done!", :action => 'show', :id => @election %>
+<% else %>
+
+<p>You can not edit the list of candidates once the election has begun.
+please return to the <%= link_to "election overview page", :action =>
+'show', :id => @election.id %>.</p>
+
+<% end %>