Merged r3452 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.9-stable@3462 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/views/mailer/_issue_text_html.rhtml b/app/views/mailer/_issue_text_html.rhtml
index d0f24781279bf8c7f25b98b08622fd053ab7d73d..3b1812d98dc6a71c2c2c4726acc3b5a9c64c8b23 100644 (file)
--- a/app/views/mailer/_issue_text_html.rhtml
+++ b/app/views/mailer/_issue_text_html.rhtml
@@ -1,14 +1,14 @@
-<h1><%= link_to "#{issue.tracker.name} ##{issue.id}: #{issue.subject}", issue_url %></h1>
+<h1><%= link_to(h("#{issue.tracker.name} ##{issue.id}: #{issue.subject}"), issue_url) %></h1>
 
 <ul>
-<li><%=l(:field_author)%>: <%= issue.author %></li>
-<li><%=l(:field_status)%>: <%= issue.status %></li>
-<li><%=l(:field_priority)%>: <%= issue.priority %></li>
-<li><%=l(:field_assigned_to)%>: <%= issue.assigned_to %></li>
-<li><%=l(:field_category)%>: <%= issue.category %></li>
-<li><%=l(:field_fixed_version)%>: <%= issue.fixed_version %></li>
+<li><%=l(:field_author)%>: <%=h issue.author %></li>
+<li><%=l(:field_status)%>: <%=h issue.status %></li>
+<li><%=l(:field_priority)%>: <%=h issue.priority %></li>
+<li><%=l(:field_assigned_to)%>: <%=h issue.assigned_to %></li>
+<li><%=l(:field_category)%>: <%=h issue.category %></li>
+<li><%=l(:field_fixed_version)%>: <%=h issue.fixed_version %></li>
 <% issue.custom_values.each do |c| %>
-  <li><%= c.custom_field.name %>: <%= show_value(c) %></li>
+  <li><%=h c.custom_field.name %>: <%=h show_value(c) %></li>
 <% end %>
 </ul>
 

diff --git a/app/views/mailer/account_activation_request.text.html.rhtml b/app/views/mailer/account_activation_request.text.html.rhtml
index 145ecfc8e1e23b0bd43b60debe98245f91844241..b19cf32198ccea23547534d7978da461313aafa0 100644 (file)
--- a/app/views/mailer/account_activation_request.text.html.rhtml
+++ b/app/views/mailer/account_activation_request.text.html.rhtml
@@ -1,2 +1,2 @@
-<p><%= l(:mail_body_account_activation_request, @user.login) %></p>
+<p><%= l(:mail_body_account_activation_request, h(@user.login)) %></p>
 <p><%= link_to @url, @url %></p>

diff --git a/app/views/mailer/account_information.text.html.rhtml b/app/views/mailer/account_information.text.html.rhtml
index 3b6ab6a9d4dc013d6e9e80990ba3294454a09b84..94c3297eddde3fe9c4fd8536393891d62888c4d4 100644 (file)
--- a/app/views/mailer/account_information.text.html.rhtml
+++ b/app/views/mailer/account_information.text.html.rhtml
@@ -1,10 +1,10 @@
 <% if @user.auth_source %>
-<p><%= l(:mail_body_account_information_external, @user.auth_source.name) %></p>
+<p><%= l(:mail_body_account_information_external, h(@user.auth_source.name)) %></p>
 <% else %>
 <p><%= l(:mail_body_account_information) %>:</p>
 <ul>
-    <li><%= l(:field_login) %>: <%= @user.login %></li>
-    <li><%= l(:field_password) %>: <%= @password %></li>
+    <li><%= l(:field_login) %>: <%=h @user.login %></li>
+    <li><%= l(:field_password) %>: <%=h @password %></li>
 </ul>
 <% end %>
 

diff --git a/app/views/mailer/attachments_added.text.html.rhtml b/app/views/mailer/attachments_added.text.html.rhtml
index d2355b1c42e90d167a7f1cb9c79c2ad0f99008d2..369834b6d320f33ed02abe5e3ba0fb16a3186898 100644 (file)
--- a/app/views/mailer/attachments_added.text.html.rhtml
+++ b/app/views/mailer/attachments_added.text.html.rhtml
@@ -1,5 +1,5 @@
 <%= link_to @added_to, @added_to_url %><br />
 
 <ul><% @attachments.each do |attachment | %>
-<li><%= attachment.filename %></li>
+<li><%=h attachment.filename %></li>
 <% end %></ul>

diff --git a/app/views/mailer/document_added.text.html.rhtml b/app/views/mailer/document_added.text.html.rhtml
index dc1f659a09750cf1375a70a36fe389c6757f8ab2..8606dd784c6a2926ba45525d8d9f2e8e8b1e909d 100644 (file)
--- a/app/views/mailer/document_added.text.html.rhtml
+++ b/app/views/mailer/document_added.text.html.rhtml
@@ -1,3 +1,3 @@
-<%= link_to @document.title, @document_url %> (<%= @document.category.name %>)<br />
+<%= link_to(h(@document.title), @document_url) %> (<%=h @document.category.name %>)<br />
 <br />
 <%= textilizable(@document, :description, :only_path => false) %>

diff --git a/app/views/mailer/issue_add.text.html.rhtml b/app/views/mailer/issue_add.text.html.rhtml
index ef1d0dec44d1fe29fe554137974e53af0a9cb793..bc62306c15c161d61184bd5b753a533edaaef4be 100644 (file)
--- a/app/views/mailer/issue_add.text.html.rhtml
+++ b/app/views/mailer/issue_add.text.html.rhtml
@@ -1,3 +1,3 @@
-<%= l(:text_issue_added, :id => "##{@issue.id}", :author => @issue.author) %>
+<%= l(:text_issue_added, :id => "##{@issue.id}", :author => h(@issue.author)) %>
 <hr />
 <%= render :partial => "issue_text_html", :locals => { :issue => @issue, :issue_url => @issue_url } %>

diff --git a/app/views/mailer/issue_edit.text.html.rhtml b/app/views/mailer/issue_edit.text.html.rhtml
index b4a1f953ed10a6cac3be678e5735426d9ced0728..05c67208e19dafbd49a2378b9f0ea52953e6cad4 100644 (file)
--- a/app/views/mailer/issue_edit.text.html.rhtml
+++ b/app/views/mailer/issue_edit.text.html.rhtml
@@ -1,4 +1,4 @@
-<%= l(:text_issue_updated, :id => "##{@issue.id}", :author => @journal.user) %>
+<%= l(:text_issue_updated, :id => "##{@issue.id}", :author => h(@journal.user)) %>
 
 <ul>
 <% for detail in @journal.details %>

diff --git a/app/views/mailer/lost_password.text.html.rhtml b/app/views/mailer/lost_password.text.html.rhtml
index 4dd570c943946bc7c04208ee9d7cb3b8a7908f73..40bb8e9c99bd00152131f86a94899d4e6ab9227c 100644 (file)
--- a/app/views/mailer/lost_password.text.html.rhtml
+++ b/app/views/mailer/lost_password.text.html.rhtml
@@ -1,4 +1,4 @@
 <p><%= l(:mail_body_lost_password) %><br />
 <%= auto_link(@url) %></p>
 
-<p><%= l(:field_login) %>: <b><%= @token.user.login %></b></p>
+<p><%= l(:field_login) %>: <b><%=h @token.user.login %></b></p>

diff --git a/app/views/mailer/message_posted.text.html.rhtml b/app/views/mailer/message_posted.text.html.rhtml
index d91ce5a0418280ed9012c8e9feeeb60f16b20033..f43a8cf0f23a47c5e8797bfc5e213b2663e8a745 100644 (file)
--- a/app/views/mailer/message_posted.text.html.rhtml
+++ b/app/views/mailer/message_posted.text.html.rhtml
@@ -1,4 +1,4 @@
-<h1><%=h @message.board.project.name %> - <%=h @message.board.name %>: <%= link_to @message.subject, @message_url %></h1>
-<em><%= @message.author %></em>
+<h1><%=h @message.board.project.name %> - <%=h @message.board.name %>: <%= link_to(h(@message.subject), @message_url) %></h1>
+<em><%=h @message.author %></em>
 
 <%= textilizable(@message, :content, :only_path => false) %>

diff --git a/app/views/mailer/news_added.text.html.rhtml b/app/views/mailer/news_added.text.html.rhtml
index 15bc89fac71d490ff5af93f026975217c41a7b0c..758ebccb8d0a7e1f1d2732e342acb3ea50baa309 100644 (file)
--- a/app/views/mailer/news_added.text.html.rhtml
+++ b/app/views/mailer/news_added.text.html.rhtml
@@ -1,4 +1,4 @@
-<h1><%= link_to @news.title, @news_url %></h1>
-<em><%= @news.author.name %></em>
+<h1><%= link_to(h(@news.title), @news_url) %></h1>
+<em><%=h @news.author.name %></em>
 
 <%= textilizable(@news, :description, :only_path => false) %>