fix security issue

[selectricity] / app / views / account / summary.rhtml

diff --git a/app/views/account/summary.rhtml b/app/views/account/summary.rhtml
index 5af431b628651dfca826bef74c10b210fd7e962d..075d0964b2fbd26b76bc9d0f1dbee96662ddb3d3 100644 (file)
--- a/app/views/account/summary.rhtml
+++ b/app/views/account/summary.rhtml
@@ -10,44 +10,39 @@ E-mail: <%=h @user.email %><br />
 Member since: <%=h @user.created_at.strftime("%x") %>
 </p>
 
+<p>
+       <%= link_to "Update Email Address", :action => 'change_contact',
+                                                                         :id => @user.id %>
+</p>
+
+
 <p>Your Elections:
   <table class="voterbox" id="election">
     <tr>
-         <% Election.content_columns.each do |column| -%>
-         <% dontPrint = ["viewable", "quickuser", "active", "anonymous", \
-                                         "early_results", "embed_custom_string", "embeddable", \
-                                         "notices"]%>
-         <% next if dontPrint.include?(column.name)%>
-           <th><%= column.human_name %></th>
+      <% ["Name", "Description", "Details"].each do |column| -%>
+           <th><%= column %></th>
          <% end -%>
     </tr>
     
     <% @user.elections.select {|e| e.instance_of?(Election)}.each do |election| %>
     <tr>
-         <td>
-       <% if election.active == 1 -%>
+         <td style="text-align: left;">
            <%= link_to "#{election.name}", :controller => 'election', 
                            :action => 'show', :id => election %>
-               <% else -%>
-                 <%=h election.name %>
-               <% end -%>
          </td>
-         <td><%=h election.description %></td>
-         <td><%=h election.startdate.strftime("%x") %></td>
-      <td><%=h election.enddate.strftime("%x") %></td>
-      <td><%=h election.election_method %></td>   
-         <td>
-                 <% if election.authenticated? %>
-              Yes
-             <% else -%>
-              No
-             <% end -%>
+         <td style="text-align: left;"><%=h election.description %></td>
+         <td style="text-align: left;">
+        <strong>Start:</strong> <%=h election.startdate.strftime("%x") %><br />
+        <strong>End:</strong> <%=h election.enddate.strftime("%x") %><br />
+        <strong>Method:</strong> <%=h ELECTION_TYPES[election.election_method] %><br />
+           <strong>Open:</strong> <%= (not election.authenticated?).to_s.capitalize %>
          </td>
          
     </tr>
     <% end -%>
   </table>
 </p>
+<p><%= link_to "Create a new election", :controller => 'election', :action => 'new' %>.</p>
 
 <br />
 
@@ -85,3 +80,4 @@ Your Quickvotes:
   </tr>
 <% end %>
 </table>
+<p><%= link_to( "Create a new QuickVote", :controller => 'quickvote', :action => 'create') %>.</p>