fixed xss bug in comment view partial.

2010-09-16 08:32:19 -07:00 · 2010-09-16 08:32:19 -07:00 · 07a8fa8bb6
commit 07a8fa8bb6
parent 32fc6212ab
1 changed files with 1 additions and 1 deletions
--- a/app/views/comments/_comment.html.haml
+++ b/app/views/comments/_comment.html.haml
@ -7,6 +7,6 @@
  = person_image_tag(post.person)
  %span.from
    = link_to post.person.real_name, post.person
-    = auto_link post.text
+    = auto_link sanitize post.text
  %div.time
    = "#{time_ago_in_words(post.updated_at)} ago"