added sanitize statements to hopefully all critical templates to protect against cross site scripting.

added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list 

2 files changed, 2 insertions, 2 deletions

diff --git a/app/views/custom/page_templates/public/no_date_and_author.html.erb b/app/views/custom/page_templates/public/no_date_and_author.html.erb
index 08911ff..ef60961 100644
--- a/app/views/custom/page_templates/public/no_date_and_author.html.erb
+++ b/app/views/custom/page_templates/public/no_date_and_author.html.erb
@@ -1,7 +1,7 @@
 <div class="article">
   <h2><%= @page.title %></h2>
   <hr class="subtitle" />
-  <p><em><%= @page.abstract %></em></p>
+  <p><em><%= sanitize( @page.abstract ) %></em></p>
   <div id="headline_image"><%= headline_image %></div>
   <%= aggregate?(@page.body) %>
 </div>
diff --git a/app/views/custom/page_templates/public/standard_template.html.erb b/app/views/custom/page_templates/public/standard_template.html.erb
index 9ce3e94..d4c80aa 100644
--- a/app/views/custom/page_templates/public/standard_template.html.erb
+++ b/app/views/custom/page_templates/public/standard_template.html.erb
@@ -2,7 +2,7 @@
   <h2><%= @page.title %></h2>
   <h3><%= date_for_page @page %>, <%= @page.user.try(:login) %></h3>
   <hr class="subtitle" />
-  <p><em><%= @page.abstract %></em></p>
+  <p><em><%= sanitize( @page.abstract )%></em></p>
   <div id="headline_image"><%= headline_image %></div>
   <%= aggregate?(@page.body) %>
 </div>