added sanitize statements to hopefully all critical templates to protect against cross site scripting.

added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list 

1 files changed, 3 insertions, 3 deletions

diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb
index 2eb0c4d..9eb7d7e 100644
--- a/app/helpers/content_helper.rb
+++ b/app/helpers/content_helper.rb
@@ -85,13 +85,13 @@ module ContentHelper
         
         options[:partial] = select_partial( options[:partial] )
 
-        content.sub(tag, render_collection(options))
+        sanitize( content.sub(tag, render_collection(options)) )
       else
-        content
+        sanitize( content )
       end
       
     rescue
-      content
+      sanatize( content )
     end
   end