fix security issue

[selectricity] / app / views / election / _voter_list.rhtml

diff --git a/app/views/election/_voter_list.rhtml b/app/views/election/_voter_list.rhtml
index c1035d7a9491b611be7584980be9ea705a4c2e8d..34aa2074d385a6f5f0d6730e5c6420473cfc84af 100644 (file)
--- a/app/views/election/_voter_list.rhtml
+++ b/app/views/election/_voter_list.rhtml
@@ -1,23 +1,23 @@
-<%
-# basic election information template
--%>
+<% if @election.voters.length == 0 %>
 
-<% unless @election.voters.empty? %>
-  <p>The following voters are currently registered for this election:</p>
+<p>There are currently no voters registered for this election.</p>
 
-  <ul>
-    <% @election.voters.each do |voter| %>
-    <div id="voter<%= voter.id %>">
-      <li><%= voter.email %>
-          <% if @edit %>
-          <%= link_to_remote "Delete",
-                      :complete => "Element.remove('voter#{voter.id}')",
-                     :url => { :action => :delete_voter, :id => voter.id } %>
-         <% end %>
-      </li>
-    </div>  
-    <% end %>
-  </ul>
-<% end %>
+<% else %>
 
+<p>The following voters are currently registered for this election:</p>
 
+<ul>
+<% @election.voters.each do |voter| %>
+  <div id="voter<%= voter.id %>">
+    <li><%= voter.email %>
+        <% if @edit %>
+        <%= link_to_remote "Delete",
+                    :complete => "Element.remove('voter#{voter.id}')",
+                    :url => { :action => :delete_voter, :id => @election.id,
+                              :voter => voter.id } %>
+        <% end %>
+    </li>
+  </div>  
+  <% end %>
+</ul>
+<% end %>