fix security issue

[selectricity] / app / views / common / _sortable_vote.rhtml

diff --git a/app/views/common/_sortable_vote.rhtml b/app/views/common/_sortable_vote.rhtml
index f026c4216378f65dfcd832b8699ce9beb6c5bb08..75bb22f51765a6795986750e29747bc47ed39e47 100644 (file)
--- a/app/views/common/_sortable_vote.rhtml
+++ b/app/views/common/_sortable_vote.rhtml
@@ -1,6 +1,6 @@
 <div id="sortable_list">
 <ol id="rankings-list">
-  <% for ranking in @voter.vote.rankings %>
+  <% for ranking in @voter.vote.rankings.sort %>
     <li class="moveable" id="ranking_<%= ranking.candidate.id %>">
       <%= white_list(ranking.candidate.name.capitalize) %></li>
   <% end %>
@@ -11,5 +11,6 @@
 
 <%= sortable_element 'rankings-list',
     :url => { :action => "sort_candidates", :id => @voter.vote.id },
+    :method => "get",
     :complete => visual_effect(:highlight, 'rankings-list') %>