fix security issue

[selectricity] / app / views / election / edit_candidates.rhtml

diff --git a/app/views/election/edit_candidates.rhtml b/app/views/election/edit_candidates.rhtml
index dcd601a9cf72b3501061a3b18bfb83126e30367b..cd0bd5ab7c99b5b05174677ddde9d0d36b26aff9 100644 (file)
--- a/app/views/election/edit_candidates.rhtml
+++ b/app/views/election/edit_candidates.rhtml
@@ -1,10 +1,33 @@
-<h2>Edit/Add Candidates</h2>
+<div id="title-header">
+  <span class="header">Edit Candidates</span>
+  <span class="subheader"></span>
+</div>
+
+<div class="clear-div"></div>
+
+<% if @election.active == 0 %>
+
+<div class="normal-header">
+  <span class="header">Enter New Candidate</span>
+  <span class="subheader"></span>
+</div>

 
 <%= error_messages_for :candidate %>
 
 
 <%= error_messages_for :candidate %>
 

-<% unless @election.candidates.empty? %>
-  <p>The following are valid options or candidates in this election:</p>
+<% form_tag( { :action => :add_candidate, :id => @election.id },
+              :multipart => true ) do %>
+<%= render :partial => 'candidate_form' %>
+<p><%= submit_tag "Add Candidate" %></p>
+<% end %>
+
+
+<div class="normal-header">
+  <span class="header">Current Candidates</span>
+  <span class="subheader"></span>
+</div>
+

 
 

+<% unless @election.candidates.empty? %>

   <% @election.candidates.each do |candidate| %>
     <% @current_candidate = candidate %>
     <%= render :partial => 'candidate_line_edit' %>
   <% @election.candidates.each do |candidate| %>
     <% @current_candidate = candidate %>
     <%= render :partial => 'candidate_line_edit' %>


@@ -14,12 +37,20 @@
   <p>There are no candidates registered for this election.</p>
 <% end %>
 
   <p>There are no candidates registered for this election.</p>
 <% end %>
 

-<p>Please enter new candidates below.</p>
+<div class="normal-header">
+  <span class="header">Continue</span>
+  <span class="subheader"></span>
+</div>

 
 

-<% form_tag( { :action => :add_candidate, :id => @election.id },
-              :multipart => true ) do %>
-<%= render :partial => 'candidate_form' %>
-<%= submit_tag "Add Candidate" %>
-<% end %>
+<p>When you are done entering candidates, please click the button below
+to proceed to the next step.</p>

 
 

-<%= button_to "Done!", :action => 'new_voters', :id => @election %>
+<%= button_to "Proceed to Next Step", :action => 'new_voters', :id => @election %>
+
+<% else %>
+
+<p>You can not edit the list of candidates once the election has begun.
+please return to the <%= link_to "election overview page", :action =>
+'show', :id => @election.id %>.</p>
+
+<% end %>