6 files changed, 22 insertions, 12 deletions

diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb
index 2eb0c4d..9eb7d7e 100644
--- a/app/helpers/content_helper.rb
+++ b/app/helpers/content_helper.rb
@@ -85,13 +85,13 @@ module ContentHelper
         
         options[:partial] = select_partial( options[:partial] )
 
-        content.sub(tag, render_collection(options))
+        sanitize( content.sub(tag, render_collection(options)) )
       else
-        content
+        sanitize( content )
       end
       
     rescue
-      content
+      sanatize( content )
     end
   end
   
diff --git a/app/views/content/_front_page_calendar.html.erb b/app/views/content/_front_page_calendar.html.erb
index 1a409a6..e7f46ba 100644
--- a/app/views/content/_front_page_calendar.html.erb
+++ b/app/views/content/_front_page_calendar.html.erb
@@ -4,7 +4,7 @@
     <% occurrences.each do |occurrence| %>
       <li>
         <div><%= l occurrence.start_time.to_date, :format => :default %></div>
-        <%= link_to_path occurrence.node.head.title, occurrence.node.unique_name %>
+        <%= link_to_path sanitize( occurrence.node.head.title ), occurrence.node.unique_name %>
       </li>
     <% end %>
   </ul>
diff --git a/app/views/custom/page_templates/public/no_date_and_author.html.erb b/app/views/custom/page_templates/public/no_date_and_author.html.erb
index 08911ff..ef60961 100644
--- a/app/views/custom/page_templates/public/no_date_and_author.html.erb
+++ b/app/views/custom/page_templates/public/no_date_and_author.html.erb
@@ -1,7 +1,7 @@
 <div class="article">
   <h2><%= @page.title %></h2>
   <hr class="subtitle" />
-  <p><em><%= @page.abstract %></em></p>
+  <p><em><%= sanitize( @page.abstract ) %></em></p>
   <div id="headline_image"><%= headline_image %></div>
   <%= aggregate?(@page.body) %>
 </div>
diff --git a/app/views/custom/page_templates/public/standard_template.html.erb b/app/views/custom/page_templates/public/standard_template.html.erb
index 9ce3e94..d4c80aa 100644
--- a/app/views/custom/page_templates/public/standard_template.html.erb
+++ b/app/views/custom/page_templates/public/standard_template.html.erb
@@ -2,7 +2,7 @@
   <h2><%= @page.title %></h2>
   <h3><%= date_for_page @page %>, <%= @page.user.try(:login) %></h3>
   <hr class="subtitle" />
-  <p><em><%= @page.abstract %></em></p>
+  <p><em><%= sanitize( @page.abstract )%></em></p>
   <div id="headline_image"><%= headline_image %></div>
   <%= aggregate?(@page.body) %>
 </div>
diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index 8f56c7c..99fb264 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -36,15 +36,15 @@
     </tr>
     <tr>
       <td class="description"><strong>Title</strong></td>
-      <td><%= @page.title %></td>
+      <td><%= sanitize( @page.title ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Abstract</strong></td>
-      <td><%= @page.abstract %></td>
+      <td><%= sanitize( @page.abstract ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Body</strong></td>
-      <td><%= @page.body %></td>
+      <td><%= sanitize( @page.body ) %></td>
     </tr>
     <tr>
       <td></td>
diff --git a/config/environment.rb b/config/environment.rb
index bff2a70..18415aa 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -30,9 +30,19 @@ Rails::Initializer.run do |config|
   # :all can be used as a placeholder for all plugins not explicitly named
   # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
 
-  # Skip frameworks you're not going to use. To use Rails without a database,
-  # you must remove the Active Record framework.
-  # config.frameworks -= [ :active_record, :active_resource, :action_mailer ]
+  # Allowed Tags
+  # strong em b i p code pre tt samp kbd var sub sup dfn cite big small 
+  # address hr br div span h1 h2 h3 h4 h5 h6 ul ol li dt dd abbr 
+  # acronym a img blockquote del ins
+  
+  # Allowed Attributes:
+  # href src width height alt cite datetime title class name xml:lang abbr))
+  
+  # Add tags to whitelist with:
+  # config.action_view.sanitized_allowed_tags = 'table', 'tr', 'td'
+  
+  # Add attributes to whitelist with:
+  # config.action_view.sanitized_allowed_attributes = 'id', 'class', 'style'
 
   # Activate observers that should always be running
   # config.active_record.observers = :cacher, :garbage_collector, :forum_observer