Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity] / app / views / quickvote / results.rhtml

diff --git a/app/views/quickvote/results.rhtml b/app/views/quickvote/results.rhtml
index e06b5d6b32b91dc855cc2ee46cb46c135457d61b..799459df0f9704d5079271d4a37e34fa979a3152 100644 (file)
--- a/app/views/quickvote/results.rhtml
+++ b/app/views/quickvote/results.rhtml
@@ -1,9 +1,10 @@
 <% %>
+<%require 'whois/whois' %>
 <h1>Results</h1>
 
 <% if @election.shortdesc %>
   <p><strong>Description:</strong></p>
-  <blockquote><em><%= @election.shortdesc %></em>
+  <blockquote><em><%=h @election.shortdesc %></em>
     <% if @election.longdesc -%>
       <br />
       <%= h(@election.longdesc) -%>
@@ -15,7 +16,7 @@
 
 <ol>
   <% for candidate in @election.candidates.sort %>
-    <li><%= candidate.name.capitalize %></li>
+    <li><%=h candidate.name.capitalize %></li>
   <% end %>
 </ol>
 
@@ -28,9 +29,9 @@
 
 <div class="mainresultbox">
 <h3>Schulze Method Results</h3>
-<%= render :partial => 'result', :object => @ssd_result %>
+<%= render :partial => 'result', :object => @election.ssd_result %>
 
-<div class="rbmoreinfo"
+<div class="rbmoreinfo">
 <h4>About the Schulze Method</h4>
 
 <p>The <%= link_to "Schulze method",
@@ -47,9 +48,9 @@ Beatpath Winner, Path Voting, and Path Winner.</p>
 
 <div class="resultbox">
 <h3>Plurality Results</h3>
-<%= render :partial => 'result', :object => @plurality_result %>
+<%= render :partial => 'result', :object => @election.plurality_result %>
 
-<div class="rbmoreinfo"
+<div class="rbmoreinfo">
 <h4>About Plurality Voting</h4>
 
 <p><%= link_to "Plurality voting",
@@ -67,9 +68,9 @@ voting.</p>
 <div class="resultbox">
 <h3>Approval Result</h3>
 <p><font size="-1">(This algorithm assumes that top two choices are "approved.")</font></p>
-<%= render :partial => 'result', :object => @approval_result %>
+<%= render :partial => 'result', :object => @election.approval_result %>
 
-<div class="rbmoreinfo"
+<div class="rbmoreinfo">
 <h4>About Approval Voting</h4>
 
 <p><%= link_to "Approval voting",
@@ -85,9 +86,9 @@ accept or not.</p>
 
 <div class="resultbox">
 <h3>Simple Condorcet Results</h3>
-<%= render :partial => 'result', :object => @condorcet_result %>
+<%= render :partial => 'result', :object => @election.condorcet_result %>
 
-<div class="rbmoreinfo"
+<div class="rbmoreinfo">
 <h4>About Simple Cordorcet Voting</h4>
 
 <p><%= link_to "Condorcet",
@@ -105,9 +106,9 @@ another Condorcet system.</p>
 
 <div class="resultbox">
 <h3>Borda Count Results</h3>
-<%= render :partial => 'result', :object => @borda_result %>
+<%= render :partial => 'result', :object => @election.borda_result %>
 
-<div class="rbmoreinfo"
+<div class="rbmoreinfo">
 <h4>About Borda Count</h4>
 
 <p><%= link_to "Borda count",
@@ -124,7 +125,7 @@ points is the winner.</p>
 <div class="resultbox">
 <h3>Instant Runoff (IRV) Results</h3>
 
-<div class="rbmoreinfo"
+<div class="rbmoreinfo">
 <h4>About Instant Runoff Voting</h4>
 
 <p><%= link_to "Instant runoff voting",
@@ -144,22 +145,41 @@ by several other names.</p>
 
 <div class="clearbox"></div>
 
-<h2>Voters</h2>
-
+<h2>Voters <%= link_to "[Stalk Voters]", :controller => "quickvote", :action => "mapvoters", :id => @election.id %></h2>
 <table class="voterbox">
 <tr>
-<th>IP Address</th>
-<th>DNS/Host</th>
+<th>IP/Host</th>
+<th>Origin</th>
 <th>Vote</th>
 </tr>
 <% for voter in @election.voters %>
   <% next unless voter.voted? %>
   <tr>
-  <td><%= voter.ipaddress %></td>
-  <td><%= `host #{voter.ipaddress}`.sub(/^.*pointer (.*)\.$/, '\1') %></td>
+    <td><% begin %>
+        <% raise ArgumentError.new, "Local Server" if voter.ipaddress == "127.0.0.1" %>
+        <% raise ArgumentError.new, "XML-RPC Voter" if voter.ipaddress == "XMLRPC Request" %>
+        <% w= Whois::Whois.new(IPAddr.new(voter.ipaddress).to_s,true)%>
+        <%=h((w.host == nil or w.host.empty?) ? voter.ipaddress : w.host)%>
+      </td>
+      <td>
+        <%w.search_whois%>
+        <%=h (w.all.grep(/^(OrgName|org-name)/)[0] or "").sub(/^(OrgName|org-name)\:/,'').strip -%> - <%=  (w.all.grep(/^(NetName|netname)/)[0] or "").sub(/^(NetName|netname)\:/,'').strip %>
+    
+    <% rescue ArgumentError => err %>
+      <%=h err %>
+    </td>
+    <td><%=h err%>
+    <% end %>
+    </td>
   <td><%= voter.vote.votestring %></td>
   </tr>
 <% end %>
 </table>
 
-<%= image_tag( graph_url( :action => 'votes_per_day', :id => @election ) ) %>
+<%= render :partial => 'victories_ties' %>
+<%= render :partial => 'pref_table' %>
+
+<%= image_tag( graph_url( :action => 'votes_per_day', :id => @election ) ) %><br />
+<%= image_tag( graph_url( :action => 'votes_per_interval', :id => @election ))%><br />
+<%= image_tag( graph_url( :action => 'borda_bar', :id => @election ) ) %><br />
+<%= image_tag( graph_url( :action => 'choices_positions', :id => @election ) ) %>