From 7672fdfdabe3ff8349fa88c5822f3e6567930916 Mon Sep 17 00:00:00 2001
From: hukl <contact@smyck.org>
Date: Fri, 1 May 2009 19:03:09 +0200
Subject: sanitizing the diff view a bit more

---
 app/views/revisions/diff.html.erb | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

(limited to 'app/views/revisions/diff.html.erb')

diff --git a/app/views/revisions/diff.html.erb b/app/views/revisions/diff.html.erb
index d02c2ad..9428b7a 100644
--- a/app/views/revisions/diff.html.erb
+++ b/app/views/revisions/diff.html.erb
@@ -11,31 +11,32 @@
   <%= submit_tag 'Diff' %>
 <% end %>
 
-
 <div id="start_title" style="display: none;">
-  <%= (@start.title) %>
+  <%= h(@start.title) %>
 </div>
 
 <div id="end_title" style="display: none;">
-  <%= (@end.title) %>
+  <%= h(@end.title) %>
 </div>
 
 <div id="start_abstract" style="display: none;">
-  <%= (@start.abstract) %>
+  <%= h(@start.abstract) %>
 </div>
 
 <div id="end_abstract" style="display: none;">
-  <%= (@end.abstract) %>
-</div>
-
-<div id="start_body" style="display: none;">
-  <%= (@start.body) %>
-</div>
-
-<div id="end_body" style="display: none;">
-  <%= (@end.body) %>
+  <%= h(@end.abstract) %>
 </div>
 
+<pre>
+  <div id="start_body" style="display: none;">
+    <%= (@start.body) %>
+  </div>
+</pre>
+<pre>
+  <div id="end_body" style="display: none;">
+    <%= (@end.body) %>
+  </div>
+</pre>
 
 <%= javascript_include_tag 'cacycle_diff' %>
 <script type="text/javascript" charset="utf-8">
-- 
cgit v1.3