Escape the title of the Note.

cooperq · Apr 21, 2009 · b66940c · b66940c
1 parent 6331565
commit b66940c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/views/notes.erb b/views/notes.erb
@@ -2,7 +2,7 @@
   <% @notes.each do |note| %>
     <p>
       <a href="/notes/<%= note.id %>" target="_blank">
-        <%= note.short_title %>
+        <%= escape_html note.short_title %>
       </a>
     </p>
   <% end %>