Escape textarea content when editing a issue note.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2143 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/views/journals/_notes_form.rhtml b/app/views/journals/_notes_form.rhtml
index 94c710ebd8e8e41fd80443289bd0f37bd3ec0ebd..6e6ad0f882ae2c201e4fc04a170b9f4fb9c489b1 100644 (file)
--- a/app/views/journals/_notes_form.rhtml
+++ b/app/views/journals/_notes_form.rhtml
@@ -1,6 +1,6 @@
 <% form_remote_tag(:url => {}, :html => { :id => "journal-#{@journal.id}-form" }) do %>
-    <%= text_area_tag :notes, @journal.notes, :class => 'wiki-edit', 
-                                              :rows => (@journal.notes.blank? ? 10 : [[10, @journal.notes.length / 50].max, 100].min) %>
+    <%= text_area_tag :notes, h(@journal.notes), :class => 'wiki-edit', 
+                                                 :rows => (@journal.notes.blank? ? 10 : [[10, @journal.notes.length / 50].max, 100].min) %>
     <%= call_hook(:view_journals_notes_form_after_notes, { :journal => @journal}) %>
     <p><%= submit_tag l(:button_save) %>
     <%= link_to l(:button_cancel), '#', :onclick => "Element.remove('journal-#{@journal.id}-form'); " +