added sanitize statements to hopefully all critical templates to protect against cross site scripting.

added section to environment.rb listing the whitelisted tags and attributes and examples on how to extend the list 

1 files changed, 3 insertions, 3 deletions

diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index 8f56c7cb..99fb264e 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -36,15 +36,15 @@
     </tr>
     <tr>
       <td class="description"><strong>Title</strong></td>
-      <td><%= @page.title %></td>
+      <td><%= sanitize( @page.title ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Abstract</strong></td>
-      <td><%= @page.abstract %></td>
+      <td><%= sanitize( @page.abstract ) %></td>
     </tr>
     <tr>
       <td class="description"><strong>Body</strong></td>
-      <td><%= @page.body %></td>
+      <td><%= sanitize( @page.body ) %></td>
     </tr>
     <tr>
       <td></td>