fix security issue

[selectricity] / app / views / common / _sortable_vote.rhtml

diff --git a/app/views/common/_sortable_vote.rhtml b/app/views/common/_sortable_vote.rhtml
index 6876966f0f44dbf6f24aae5aa996c49acfa3e4f7..75bb22f51765a6795986750e29747bc47ed39e47 100644 (file)
--- a/app/views/common/_sortable_vote.rhtml
+++ b/app/views/common/_sortable_vote.rhtml
@@ -1,8 +1,8 @@
 <div id="sortable_list">
 <ol id="rankings-list">
-  <% for ranking in @voter.vote.rankings %>
+  <% for ranking in @voter.vote.rankings.sort %>
     <li class="moveable" id="ranking_<%= ranking.candidate.id %>">
-      <%=h ranking.candidate.name.capitalize %></li>
+      <%= white_list(ranking.candidate.name.capitalize) %></li>
   <% end %>
 </ol>
 </div>
@@ -11,5 +11,6 @@
 
 <%= sortable_element 'rankings-list',
     :url => { :action => "sort_candidates", :id => @voter.vote.id },
+    :method => "get",
     :complete => visual_effect(:highlight, 'rankings-list') %>