From 9883c149e539cf4700ad2d9cf33ee012dd3bd750 Mon Sep 17 00:00:00 2001
From: Marek Labos <keraml@gmail.com>
Date: Fri, 17 Aug 2012 16:42:47 +0200
Subject: escape title and tags in templates

---
 app/views/refinery/blog/posts/_nav.html.erb   | 4 ++--
 app/views/refinery/blog/posts/tagged.html.erb | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'app')

diff --git a/app/views/refinery/blog/posts/_nav.html.erb b/app/views/refinery/blog/posts/_nav.html.erb
index eafd35e..9e87e6e 100644
--- a/app/views/refinery/blog/posts/_nav.html.erb
+++ b/app/views/refinery/blog/posts/_nav.html.erb
@@ -1,6 +1,6 @@
 <nav id="next_prev_article">
   <% if @post.next.present? -%>
-    <%= link_to (truncate(@post.next.title) + " &#187;").html_safe, 
+    <%= link_to (h(truncate(@post.next.title)) + " &#187;").html_safe, 
                 refinery.blog_post_path(@post.next), 
                 :class => 'next' %>
   <% end -%>
@@ -10,7 +10,7 @@
               :class => 'home' %>
 
   <% if @post.prev.present? -%>
-    <%= link_to ("&#171; " + truncate(@post.prev.title)).html_safe, 
+    <%= link_to ("&#171; " + h(truncate(@post.prev.title))).html_safe, 
                 refinery.blog_post_path(@post.prev), 
                 :class => 'prev' %>
   <% end -%>
diff --git a/app/views/refinery/blog/posts/tagged.html.erb b/app/views/refinery/blog/posts/tagged.html.erb
index c22e55b..89e1415 100644
--- a/app/views/refinery/blog/posts/tagged.html.erb
+++ b/app/views/refinery/blog/posts/tagged.html.erb
@@ -1,6 +1,6 @@
 <% content_for :title, "#{t('.posts_tagged')} '#{@tag_name.titleize}'"  %>
 
-<% content_for :body_content_title, "#{t('.posts_tagged')} &#8220;#{@tag_name.titleize}&#8221;".html_safe -%>
+<% content_for :body_content_title, "#{t('.posts_tagged')} &#8220;#{h(@tag_name.titleize)}&#8221;".html_safe -%>
 
 <% content_for :body do %>
   <% if @posts.any? %>
-- 
cgit v1.2.3