Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity] / app / views / quickvote / _candidate_list.rhtml

diff --git a/app/views/quickvote/_candidate_list.rhtml b/app/views/quickvote/_candidate_list.rhtml
index 64aa97926c228cdb0813e0096965d4f005aec67d..ddb47e53fa7f6a49b707bcecdb530e5ef0dd1a54 100644 (file)
--- a/app/views/quickvote/_candidate_list.rhtml
+++ b/app/views/quickvote/_candidate_list.rhtml
@@ -3,7 +3,7 @@
 <% if flash[:candlist] %>
   <ul>
   <% for cand in flash[:candlist] %>
-    <li><%= cand.capitalize %></li>
+    <li><%=h cand.capitalize %></li>
   <% end %>
   </ul>
 <% end %>