HTML escape description to prevent code injection onto page

[selectricity] / app / controllers / site_controller.rb

diff --git a/app/controllers/site_controller.rb b/app/controllers/site_controller.rb
index 6e77b48ef02835d4a176c8c2af24c852e37d0d6a..a33a1fa16707403589ce4caebd0bb36161bb30d9 100644 (file)
--- a/app/controllers/site_controller.rb
+++ b/app/controllers/site_controller.rb
@@ -1,6 +1,27 @@
 class SiteController < ApplicationController
-  layout 'vb'
+  layout 'main'
+  model :user, :election, :account
 
   def index
+    @quickvotes = QuickVote.find(:all).sort {|a,b| b.enddate <=> a.enddate}[0..1]
+    # if the person claims they are logged in
+   
+    if logged_in?
+      # check to see that we actually have record of them
+      if User.exists?(session[:user])
+        username = User.find(session[:user]).login
+        # if we have record of them, grab the list of their elections
+        session[:user] = User.find(session[:user])
+        @current_elections = session[:user].elections.sort do |a,b|
+          b.enddate <=> a.enddate
+        end
+      else
+        # if we have no record of them, set the user back to
+             # nothing and start again
+        session[:user] = nil
+        
+      end
+    end
   end
+
 end