various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/my/blocks/_calendar.rhtml

@@ -34,7 +34,7 @@ while day <= @date_to
 		elsif day == i.due_date
 		    image_tag('arrow_to') 
 		end %>
-		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
+		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
 	<% end %>
     </td>
 	<%= '</tr><tr height="100">' if day.cwday >= 7 and day!=@date_to %>

app/views/my/blocks/_documents.rhtml

@@ -1,15 +1,7 @@
 <h3><%=l(:label_document_plural)%></h3>
 
-<ul>
-<% for document in Document.find :all,
+<%= render(:partial => 'documents/document',
+           :collection => Document.find(:all,
                          :limit => 10,
                          :conditions => "documents.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
-                         :include => [:project] %>
-	<li>
-	<b><%= link_to document.title, :controller => 'documents', :action => 'show', :id => document %></b>
-	<br />
-	<%= truncate document.description, 150 %><br />
-	<em><%= format_time(document.created_on) %></em><br />&nbsp;
-	</li>
-<% end unless @user.projects.empty? %>
-</ul>
+                         :include => [:project])) unless @user.projects.empty? %>

app/views/my/blocks/_latest_news.rhtml

@@ -1,13 +1,7 @@
 <h3><%=l(:label_news_latest)%></h3>
 
-<ul>
-<% for news in News.find :all,
-                         :limit => 10,
-                         :conditions => "news.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
-                         :include => [:project, :author] %>
-	<li><%= link_to news.title, :controller => 'news', :action => 'show', :id => news %><br />
-	<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
-	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />&nbsp;
-	</li>
-<% end unless @user.projects.empty? %>
-</ul>
+<%= render (:partial => 'news/news', 
+            :collection => News.find(:all,
+                                     :limit => 10,
+                                     :conditions => "news.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
+                                     :include => [:project, :author])) unless @user.projects.empty? %>

app/views/my/page.rhtml

@@ -1,9 +1,9 @@
-<h2><%=l(:label_my_page)%></h2>
-
-<div class="topright">
-    <small><%= link_to l(:label_personalize_page), :action => 'page_layout' %></small>
+<div class="contextual">
+    <%= link_to l(:label_personalize_page), :action => 'page_layout' %>
 </div>
 
+<h2><%=l(:label_my_page)%></h2>
+
 <div id="list-top">
 	<% @blocks['top'].each do |b| %>
 	<div class="mypage-box">        

app/views/my/page_layout.rhtml

@@ -34,11 +34,10 @@ function removeBlock(block) {
 
 </script>
 
-<div style="float:right;">
+<div class="contextual">
+<span id="indicator" style="display:none"><%= image_tag "loading.gif", :align => "absmiddle" %></span>
 <%= start_form_tag({:action => "add_block"}, :id => "block-form") %>
-
-<%= select_tag 'block', "<option></option>" + options_for_select(@block_options), :id => "block-select", :class => "select-small" %>
-<small>
+<%= select_tag 'block', "<option></option>" + options_for_select(@block_options), :id => "block-select" %>
 <%= link_to_remote l(:button_add),
             :url => { :action => "add_block" },
             :with => "Form.serialize('block-form')",
@@ -48,16 +47,9 @@ function removeBlock(block) {
             :loading => "Element.show('indicator')",
             :loaded => "Element.hide('indicator')"
              %>
-</small>
-<%= end_form_tag %> 
-<small>|
+<%= end_form_tag %> |
 <%= link_to l(:button_save), :action => 'page_layout_save' %> |
 <%= link_to l(:button_cancel), :action => 'page' %>
-</small>
-</div>
-
-<div style="float:right;margin-right:20px;">
-<span id="indicator" style="display:none"><%= image_tag "loading.gif" %></span>
 </div>
 
 <h2><%=l(:label_my_page)%></h2>