Escape person.name in comment

2010-12-26 02:09:25 +01:00 · 2010-12-26 02:09:25 +01:00 · d6e72cd2bb
commit d6e72cd2bb
parent 3e9cce2a4b
1 changed files with 1 additions and 1 deletions
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@ -129,7 +129,7 @@ module ApplicationHelper

  def person_link(person)
    "<a href='/people/#{person.id}'>
-  #{person.name}
+  #{h(person.name)}
 </a>".html_safe
  end