@@ -9,13 +9,13 @@ <tr> <td> <%- if comment.url? -%> - <%= link_to comment.author, comment.url -%> + <%= link_to h(comment.author), h(comment.url) -%> <%- else -%> <%= comment.author -%> <%- end -%> </td> <td><%= mail_to comment.email, false, { :replace_at => ' [at] ', :encode => 'javascript' } -%></td> - <td></td> + <td><%= comment.body(:source) -%></td> <td><%= link_to :show, post_comment_path(@post, comment) %></td> <td><%= link_to :edit, edit_post_comment_path(@post, comment) %></td> <td><%= link_to :destroy, post_comment_path(@post, comment), :confirm => 'are you sure?', :method => :delete %></td> app/views/comments/index.html.erb 5d0c8ea3fe4a54fb8d33d5cc835345ab4220b4cd tweak tweakr@gmail.com http://github.com/tweak/blog/commit/373eb50d23f9aff1a2aafd00d5a9f9660dc85d4a 373eb50d23f9aff1a2aafd00d5a9f9660dc85d4a 2009-11-08T13:40:50-08:00 2009-11-08T13:40:50-08:00 added comment body and escaping to author and url 173ca22d564b1daa577f369d8ea3d3b1d51d8a84 tweak tweakr@gmail.com