Escape content and mark known link as HTML safe to prevent it being e…

…scaped.
mysociety · Apr 8, 2013 · e283db7 · e283db7
1 parent 8021184
commit e283db7
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/views/admin_request/show.rhtml b/app/views/admin_request/show.rhtml
@@ -258,7 +258,7 @@
                 </td>
                 <td>
                   <% if column_name == 'body' %>
-                    <%= simple_format(truncate(outgoing_message.body, :length => 400, :omission => link_to("...", "#", :class => "toggle-hidden" ))) %>
+                    <%= simple_format(truncate(h(outgoing_message.body), :length => 400, :omission => link_to("...", "#", :class => "toggle-hidden" )).html_safe) %>
                     <div style="display:none;"><%= simple_format( outgoing_message.body ) %></div>
                   <% else %>
                     <%= admin_value(value) %>
@@ -303,7 +303,7 @@
                 </td>
                 <td>
                   <% if column_name =~ /^cached_.*?$/ %>
-                    <%= simple_format( truncate(value, :length => 400, :omission => link_to("...", "#", :class => "toggle-hidden"))) %>
+                    <%= simple_format( truncate(h(value), :length => 400, :omission => link_to("...", "#", :class => "toggle-hidden")).html_safe) %>
                     <div style="display:none;"><%= simple_format(value) %></div>
                   <% else %>
                     <%= simple_format(value) %>