From 500b29d84cc966fa62d0f899ca25049d1dc30ccf Mon Sep 17 00:00:00 2001
From: Toshi MARUYAMA <marutosijp2@yahoo.co.jp>
Date: Tue, 2 Aug 2011 12:56:45 +0000
Subject: [PATCH] HTML escape at app/views/attachments/diff.rhtml.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6361 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/views/attachments/diff.rhtml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/attachments/diff.rhtml b/app/views/attachments/diff.rhtml
index 36db0af52..36e47217b 100644
--- a/app/views/attachments/diff.rhtml
+++ b/app/views/attachments/diff.rhtml
@@ -2,7 +2,7 @@
 
 <div class="attachments">
 <p><%= h("#{@attachment.description} - ") unless @attachment.description.blank? %>
-   <span class="author"><%= @attachment.author %>, <%= format_time(@attachment.created_on) %></span></p>
+   <span class="author"><%= link_to_user(@attachment.author) %>, <%= format_time(@attachment.created_on) %></span></p>
 <p><%= link_to_attachment @attachment, :text => l(:button_download), :download => true -%>
    <span class="size">(<%= number_to_human_size @attachment.filesize %>)</span></p>
 
@@ -10,7 +10,7 @@
 &nbsp;
 <%= render :partial => 'common/diff', :locals => {:diff => @diff, :diff_type => @diff_type} %>
 
-<% html_title @attachment.filename %>
+<% html_title h(@attachment.filename) %>
 
 <% content_for :header_tags do -%>
     <%= stylesheet_link_tag "scm" -%>
-- 
2.39.5