fix security issue

[selectricity] / app / views / election / edit_voters.rhtml

diff --git a/app/views/election/edit_voters.rhtml b/app/views/election/edit_voters.rhtml
index 77093fe5262db3783c7589a014291708b199e5ef..770c5ecdabed0819ea47a1a4479d757345941147 100644 (file)
--- a/app/views/election/edit_voters.rhtml
+++ b/app/views/election/edit_voters.rhtml
@@ -3,8 +3,13 @@
   <span class="subheader"></span>
 </div>
 
-<p id="unauth_notice" <%= 'style="display: none;"' if @election.authenticated %>>Anyone will be able to
-vote in this election.</p>
+<% if @election.active == 0 %>
+
+<p id="unauth_notice" <%= 'style="display: none;"' if @election.authenticated %>>
+<% if @election.kiosk? %>
+  <em>Because you have enabled kiosk mode, there will be no registration of voters.</em>
+<% end %>
+Anyone will be able to vote in this election.</p>
 
 <div id="voter_info_box" <%= 'style="display: none;"' unless @election.authenticated %>>
 <%= render :partial => 'voter_list' %>
@@ -14,7 +19,9 @@ vote in this election.</p>
 <% end %>
 </div>
 
-<%= check_box :election, :authenticated %> Only allow registered voters 
+<% unless @election.kiosk? %>
+  <%= check_box :election, :authenticated %> Only allow registered voters 
+<% end %>
 
 <%= observe_field "election_authenticated",
       :url => { :action => 'toggle_authenticated', :id => @election.id },
@@ -32,4 +39,13 @@ vote in this election.</p>
 <p>When you are done entering voters, please click the button below
 to proceed to the next step.</p>
 
-<%= button_to 'Proceed to Next Step!', :action => 'show', :id => @election.id %>
+<%= button_to 'Proceed to Next Step', :action => 'show', :id => @election.id %>
+
+<% else %>
+
+<p>You can not edit the list of voters once the election has begun.
+please return to the <%= link_to "election overview page", :action =>
+'show', :id => @election.id %>.</p>
+
+<% end %>
+