Merged from jdong; lots of escaping fixes

[selectricity] / app / views / quickvote / index.rhtml

diff --git a/app/views/quickvote/index.rhtml b/app/views/quickvote/index.rhtml
old mode 100755 (executable)
new mode 100644 (file)
index eb37845..1179b7c
--- a/app/views/quickvote/index.rhtml
+++ b/app/views/quickvote/index.rhtml
@@ -1,14 +1,14 @@
 <% %>
 
 <% if @voter.election.shortdesc %>
-  <h1><%= @voter.election.shortdesc %></h1>
+  <h1><%=h @voter.election.shortdesc %></h1>
 <% else %>
   <h1>QuickVote</h1>
 <% end %>
 
 <% if @voter.election.longdesc %>
   <p><strong>Description:</strong></p>
-  <blockquote><%= @voter.election.longdesc %></blockquote>
+  <blockquote><%=h @voter.election.longdesc %></blockquote>
 
 <h2>Vote</h2>
 <% end %>
@@ -17,9 +17,9 @@
   <p>You have already voted. You can:</p>
   
   <ul>
-    <li><%= link_to "Change your vote.", quickaction_url( :votename => @voter.election.name, :action => 'change' ) %></li>
+    <li><%= link_to "Change your vote.", quickaction_url( :ident => @voter.election.name, :action => 'change' ) %></li>
 
-    <li><%= link_to "View election results.", quickaction_url( :votename => @voter.election.name, :action => 'results' ) %></li>
+    <li><%= link_to "View election results.", quickaction_url( :ident => @voter.election.name, :action => 'results' ) %></li>
   </ul>
 <% else %>
 
@@ -31,14 +31,14 @@ bottom</em>. When you are done, press confirm to record your vote.</p>
 <ol id="rankings-list">
   <% for ranking in @voter.vote.rankings %>
     <li class="moveable" id="ranking_<%= ranking.candidate.id %>">
-      <%= ranking.candidate.name.capitalize %></li>
+      <%=h ranking.candidate.name.capitalize %></li>
   <% end %>
 </ol>
 </div>
 
 <div class="clearbox"></div>
 
-<%= button_to "Confirm Vote", quickaction_url( :action => 'confirm', :votename => @voter.election.name)  %>
+<%= button_to "Confirm Vote", quickaction_url( :action => 'confirm', :ident => @voter.election.name)  %>
 
 <%= sortable_element 'rankings-list',
     :url => { :action => "sort_candidates" , :id => @voter.vote.id },