various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/my/blocks/_calendar.rhtml

@@ -34,7 +34,7 @@ while day <= @date_to
 		elsif day == i.due_date
 		    image_tag('arrow_to') 
 		end %>
-		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
+		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
 	<% end %>
     </td>
 	<%= '</tr><tr height="100">' if day.cwday >= 7 and day!=@date_to %>

app/views/my/blocks/_documents.rhtml

@@ -1,15 +1,7 @@
 <h3><%=l(:label_document_plural)%></h3>
 
-<ul>
-<% for document in Document.find :all,
+<%= render(:partial => 'documents/document',
+           :collection => Document.find(:all,
                          :limit => 10,
                          :conditions => "documents.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
-                         :include => [:project] %>
-	<li>
-	<b><%= link_to document.title, :controller => 'documents', :action => 'show', :id => document %></b>
-	<br />
-	<%= truncate document.description, 150 %><br />
-	<em><%= format_time(document.created_on) %></em><br />&nbsp;
-	</li>
-<% end unless @user.projects.empty? %>
-</ul>
+                         :include => [:project])) unless @user.projects.empty? %>

app/views/my/blocks/_latest_news.rhtml

@@ -1,13 +1,7 @@
 <h3><%=l(:label_news_latest)%></h3>
 
-<ul>
-<% for news in News.find :all,
-                         :limit => 10,
-                         :conditions => "news.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
-                         :include => [:project, :author] %>
-	<li><%= link_to news.title, :controller => 'news', :action => 'show', :id => news %><br />
-	<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
-	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />&nbsp;
-	</li>
-<% end unless @user.projects.empty? %>
-</ul>
+<%= render (:partial => 'news/news', 
+            :collection => News.find(:all,
+                                     :limit => 10,
+                                     :conditions => "news.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
+                                     :include => [:project, :author])) unless @user.projects.empty? %>