From 4d9d211e41d983dbaed50524cc0a91666d3bf728 Mon Sep 17 00:00:00 2001
From: Benjamin Kellermann <Benjamin.Kellermann@gmx.de>
Date: Mon, 8 Jun 2009 13:18:50 +0200
Subject: better approach to edit participant

---
 poll.rb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'poll.rb')

diff --git a/poll.rb b/poll.rb
index bf90b58..784f322 100644
--- a/poll.rb
+++ b/poll.rb
@@ -49,7 +49,7 @@ class Poll
 			ret += "<tr class='participantrow'>\n"
 			ret += "<td class='name' #{$cgi["edit"] == participant ? "id='active'":""}>"
 			ret += participant
-			ret += " <sup><a href='?edit=#{CGI.escape(participant)}'>edit</a></sup>" unless config
+			ret += " <sup><a href=\"?edit=#{CGI.escapeHTML(CGI.escape(participant))}\">edit</a></sup>" unless config
 			ret += "</td>\n"
 			@head.sort.each{|columntitle,columndescription|
 				klasse = poll[columntitle]
@@ -119,6 +119,7 @@ class Poll
 			participant = $cgi["edit"]
 			@head.each_key{|k| checked[k] = @data[participant][k]}
 		else
+			participant = ""
 			@head.each_key{|k| checked[k] = NOVAL}
 		end
 		ret = "<tr id='add_participant'>\n"
@@ -126,7 +127,7 @@ class Poll
 			<input size='16' 
 				type='text' 
 				name='add_participant'
-				value='#{participant}'
+				value=\"#{CGI.escapeHTML(participant)}\"
 				title='To change a line, add a new person with the same name!' />
 			</td>\n"
 		@head.sort.each{|columntitle,columndescription|
-- 
cgit v1.2.3