From: Toshi MARUYAMA <marutosijp2@yahoo.co.jp>
Date: Tue, 2 Aug 2011 13:03:51 +0000 (+0000)
Subject: HTML escape at app/views/issues/_list_simple.rhtml.
X-Git-Tag: 1.3.0~1573
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=eb9689d386d5650062f6830142156719a3493ac7;p=redmine.git

HTML escape at app/views/issues/_list_simple.rhtml.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6370 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/views/issues/_list_simple.rhtml b/app/views/issues/_list_simple.rhtml
index dd7f48946..1fcb07aee 100644
--- a/app/views/issues/_list_simple.rhtml
+++ b/app/views/issues/_list_simple.rhtml
@@ -9,10 +9,10 @@
 		</tr></thead>
 		<tbody>	
 		<% for issue in issues %>
-		<tr id="issue-<%= issue.id %>" class="hascontextmenu <%= cycle('odd', 'even') %> <%= issue.css_classes %>">
+		<tr id="issue-<%= h(issue.id) %>" class="hascontextmenu <%= cycle('odd', 'even') %> <%= issue.css_classes %>">
 			<td class="id">
 			  <%= check_box_tag("ids[]", issue.id, false, :style => 'display:none;') %>
-				<%= link_to issue.id, :controller => 'issues', :action => 'show', :id => issue %>
+				<%= link_to(h(issue.id), :controller => 'issues', :action => 'show', :id => issue) %>
 			</td>
 			<td class="project"><%= link_to_project(issue.project) %></td>
 			<td class="tracker"><%=h issue.tracker %></td>