jro_apps/redmine Commit - r96:2b86ef8e28d0

various modifications to prevent xss...

Jean-Philippe Lang -

r96:2b86ef8e28d0

parent child

Context file:

r96:2b86ef8e28d0

Expand all files

app/views/documents/_document.rhtml created 644 +3 0

@@ -0,0 +1,3
	1	<p><%= link_to h(document.title), :controller => 'documents', :action => 'show', :id => document %><br />
	2	<% unless document.description.empty? %><%=h truncate document.description, 250 %><br /><% end %>
	3	<em><%= format_time(document.created_on) %></em></p> No newline at end of file

app/views/news/_news.rhtml created 644 +4 0

@@ -0,0 +1,4
	1	<p><%= link_to h(news.title), :controller => 'news', :action => 'show', :id => news %><br />
	2	<% unless news.summary.empty? %><%=h news.summary %><br /><% end %>
	3	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />
	4	<%= news.comments_count %> <%= lwr(:label_comment, news.comments_count).downcase %><br /></p>

app/helpers/issues_helper.rb +3 -3

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             module IssuesHelper
               def show_detail(detail, no_html=false)
                 case detail.property
                 when 'attr'
                   label = l(("field_" + detail.prop_key.to_s.gsub(/\_id$/, "")).to_sym)
                   case detail.prop_key
                   when 'due_date', 'start_date'
                     value = format_date(detail.value.to_date) if detail.value
                     old_value = format_date(detail.old_value.to_date) if detail.old_value
                   when 'status_id'
                     s = IssueStatus.find_by_id(detail.value) and value = s.name if detail.value
                     s = IssueStatus.find_by_id(detail.old_value) and old_value = s.name if detail.old_value
                   when 'assigned_to_id'
                     u = User.find_by_id(detail.value) and value = u.name if detail.value
                     u = User.find_by_id(detail.old_value) and old_value = u.name if detail.old_value
                   when 'priority_id'
                     e = Enumeration.find_by_id(detail.value) and value = e.name if detail.value
                     e = Enumeration.find_by_id(detail.old_value) and old_value = e.name if detail.old_value
                   when 'category_id'
                     c = IssueCategory.find_by_id(detail.value) and value = c.name if detail.value
                     c = IssueCategory.find_by_id(detail.old_value) and old_value = c.name if detail.old_value
                   when 'fixed_version_id'
                     v = Version.find_by_id(detail.value) and value = v.name if detail.value
                     v = Version.find_by_id(detail.old_value) and old_value = v.name if detail.old_value
                   end
                 when 'cf'
                   custom_field = CustomField.find_by_id(detail.prop_key)
                   if custom_field
                     label = custom_field.name
                     value = format_value(detail.value, custom_field.field_format) if detail.value
                     old_value = format_value(detail.old_value, custom_field.field_format) if detail.old_value
                   end
                 end
                 label ||= detail.prop_key
                 value ||= detail.value
                 old_value ||= detail.old_value
                 unless no_html
                   label = content_tag('strong', label)
-                  old_value = content_tag("i", old_value) if old_value
+                  old_value = content_tag("i", h(old_value)) if old_value
-                  old_value = content_tag("strike", old_value) if old_value and !value
+                  old_value = content_tag("strike", h(old_value)) if old_value and !value
-                  value = content_tag("i", value) if value
+                  value = content_tag("i", h(value)) if value
                 end
                 if value
                   if old_value
                     label + " " + l(:text_journal_changed, old_value, value)
                   else
                     label + " " + l(:text_journal_set_to, value)
                   end
                 else
                   label + " " + l(:text_journal_deleted) + " (#{old_value})"
                 end
               end
             end

app/models/custom_field.rb +1 0

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class CustomField < ActiveRecord::Base
               has_many :custom_values, :dependent => true
               FIELD_FORMATS = { "list" => :label_list,
             			        "date" => :label_date,
             			        "bool" => :label_boolean,
             			        "int" => :label_integer,
             			        "string" => :label_string,
             			        "text" => :label_text
               }.freeze
               validates_presence_of :name, :field_format
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               validates_inclusion_of :field_format, :in => FIELD_FORMATS.keys
               validates_presence_of :possible_values, :if => Proc.new { |field| field.field_format == "list" }
               # to move in project_custom_field
               def self.for_all
                 find(:all, :conditions => ["is_for_all=?", true])
               end
               def type_name
                 nil
               end
             end

app/models/enumeration.rb +3 -2

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Enumeration < ActiveRecord::Base
               before_destroy :check_integrity
-            	validates_presence_of :opt, :name
+              validates_presence_of :opt, :name
-            	validates_uniqueness_of :name, :scope => [:opt]
+              validates_uniqueness_of :name, :scope => [:opt]
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
             	OPTIONS = {
             	  "IPRI" => :enumeration_issue_priorities,
                   "DCAT" => :enumeration_doc_categories
             	}.freeze
             	def self.get_values(option)
             		find(:all, :conditions => ['opt=?', option])
             	end
               def option_name
                 OPTIONS[self.opt]
               end
             private
               def check_integrity
                 case self.opt
                 when "IPRI"
                   raise "Can't delete enumeration" if Issue.find(:first, :conditions => ["priority_id=?", self.id])
                 when "DCAT"
                   raise "Can't delete enumeration" if Document.find(:first, :conditions => ["category_id=?", self.id])
                 end
               end
             end

app/models/issue_status.rb +1 0

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class IssueStatus < ActiveRecord::Base
               before_destroy :check_integrity
               has_many :workflows, :foreign_key => "old_status_id"
               validates_presence_of :name
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               validates_length_of :html_color, :is => 6
               validates_format_of :html_color, :with => /^[a-f0-9]*$/i
               def before_save
                 IssueStatus.update_all "is_default=false" if self.is_default?
               end
               # Returns the default status for new issues
               def self.default
                 find(:first, :conditions =>["is_default=?", true])
               end
               # Returns an array of all statuses the given role can switch to
               def new_statuses_allowed_to(role, tracker)
                 statuses = []
                 for workflow in self.workflows
                   statuses << workflow.new_status if workflow.role_id == role.id and workflow.tracker_id == tracker.id
                 end unless role.nil? or tracker.nil?
                 statuses
               end
             private
               def check_integrity
                 raise "Can't delete status" if Issue.find(:first, :conditions => ["status_id=?", self.id]) or IssueHistory.find(:first, :conditions => ["status_id=?", self.id])
               end
             end

app/models/project.rb +1 0

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Project < ActiveRecord::Base
               has_many :versions, :dependent => true, :order => "versions.effective_date DESC, versions.name DESC"
               has_many :members, :dependent => true
               has_many :users, :through => :members
               has_many :custom_values, :dependent => true, :as => :customized
               has_many :issues, :dependent => true, :order => "issues.created_on DESC", :include => [:status, :tracker]
               has_many :queries, :dependent => true
               has_many :documents, :dependent => true
               has_many :news, :dependent => true, :include => :author
               has_many :issue_categories, :dependent => true, :order => "issue_categories.name"
               has_and_belongs_to_many :custom_fields, :class_name => 'IssueCustomField', :join_table => 'custom_fields_projects', :association_foreign_key => 'custom_field_id'
               acts_as_tree :order => "name", :counter_cache => true
               validates_presence_of :name, :description
               validates_uniqueness_of :name
               validates_associated :custom_values, :on => :update
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               # returns 5 last created projects
               def self.latest
                 find(:all, :limit => 5, :order => "created_on DESC")
               end
               # Returns an array of all custom fields enabled for project issues
               # (explictly associated custom fields and custom fields enabled for all projects)
               def custom_fields_for_issues(tracker)
                 tracker.custom_fields.find(:all, :include => :projects,
                                            :conditions => ["is_for_all=? or project_id=?", true, self.id])
                 #(CustomField.for_all + custom_fields).uniq
               end
               def all_custom_fields
                 @all_custom_fields ||= IssueCustomField.find(:all, :include => :projects,
                                            :conditions => ["is_for_all=? or project_id=?", true, self.id])
               end
             protected
               def validate
                 errors.add(parent_id, " must be a root project") if parent and parent.parent
                 errors.add_to_base("A project with subprojects can't be a subproject") if parent and projects_count > 0
               end
             end

app/models/role.rb +1 0

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Role < ActiveRecord::Base
               before_destroy :check_integrity
               has_and_belongs_to_many :permissions
               has_many :workflows, :dependent => true
               has_many :members
               validates_presence_of :name
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
             private
               def check_integrity
                 raise "Can't delete role" if Member.find(:first, :conditions =>["role_id=?", self.id])
               end
             end

app/models/tracker.rb +2 -1

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Tracker < ActiveRecord::Base
               before_destroy :check_integrity
               has_many :issues
               has_many :workflows, :dependent => true
               has_and_belongs_to_many :custom_fields, :class_name => 'IssueCustomField', :join_table => 'custom_fields_trackers', :association_foreign_key => 'custom_field_id'
               validates_presence_of :name
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
             private
               def check_integrity
                 raise "Can't delete tracker" if Issue.find(:first, :conditions => ["tracker_id=?", self.id])
               end
             end

app/models/user.rb +2 -1

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "digest/sha1"
             class User < ActiveRecord::Base
               has_many :memberships, :class_name => 'Member', :include => [ :project, :role ], :dependent => true
               has_many :projects, :through => :memberships
               has_many :custom_values, :dependent => true, :as => :customized
               has_one :preference, :dependent => true, :class_name => 'UserPreference'
               belongs_to :auth_source
               attr_accessor :password, :password_confirmation
               attr_accessor :last_before_login_on
               # Prevents unauthorized assignments
               attr_protected :login, :admin, :password, :password_confirmation, :hashed_password
               validates_presence_of :login, :firstname, :lastname, :mail
               validates_uniqueness_of :login, :mail
               # Login must contain lettres, numbers, underscores only
-              validates_format_of :login, :with => /^[a-z0-9_]+$/i
+              validates_format_of :firstname, :lastname, :with => /^[\w\s\'\-]*$/i
+              validates_format_of :login, :with => /^[a-z0-9_\-@\.]+$/i
               validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i
               # Password length between 4 and 12
               validates_length_of :password, :in => 4..12, :allow_nil => true
               validates_confirmation_of :password, :allow_nil => true
               validates_associated :custom_values, :on => :update
               # Account statuses
               STATUS_ACTIVE     = 1
               STATUS_REGISTERED = 2
               STATUS_LOCKED     = 3
               def before_save
                 # update hashed_password if password was set
                 self.hashed_password = User.hash_password(self.password) if self.password
               end
               # Returns the user that matches provided login and password, or nil
               def self.try_to_login(login, password)
                 user = find(:first, :conditions => ["login=?", login])
                 if user
                   # user is already in local database
                   return nil if !user.active?
                   if user.auth_source
                     # user has an external authentication method
                     return nil unless user.auth_source.authenticate(login, password)
                   else
                     # authentication with local password
                     return nil unless User.hash_password(password) == user.hashed_password
                   end
                 else
                   # user is not yet registered, try to authenticate with available sources
                   attrs = AuthSource.authenticate(login, password)
                   if attrs
                     onthefly = new(*attrs)
                     onthefly.login = login
                     onthefly.language = $RDM_DEFAULT_LANG
                     if onthefly.save
                       user = find(:first, :conditions => ["login=?", login])
                       logger.info("User '#{user.login}' created on the fly.") if logger
                     end
                   end
                 end
                 user.update_attribute(:last_login_on, Time.now) if user
                 user
                 rescue => text
                   raise text
               end
               # Return user's full name for display
               def display_name
                 firstname + " " + lastname
               end
               def name
                 display_name
               end
               def active?
                 self.status == STATUS_ACTIVE
               end
               def registered?
                 self.status == STATUS_REGISTERED
               end
               def locked?
                 self.status == STATUS_LOCKED
               end
               def check_password?(clear_password)
                 User.hash_password(clear_password) == self.hashed_password
               end
               def role_for_project(project_id)
                 @role_for_projects ||=
                   begin
                     roles = {}
                     self.memberships.each { |m| roles.store m.project_id, m.role_id }
                     roles
                   end
                 @role_for_projects[project_id]
               end
               def pref
                 self.preference ||= UserPreference.new(:user => self)
               end
             private
               # Return password digest
               def self.hash_password(clear_password)
                 Digest::SHA1.hexdigest(clear_password || "")
               end
             end

app/views/admin/projects.rhtml +1 -1

             <div class="contextual">
             <%= link_to l(:label_project_new), {:controller => 'projects', :action => 'add'}, :class => 'pic picAdd' %>
             </div>
             <h2><%=l(:label_project_plural)%></h2>
             <table class="listTableContent">
               <tr class="ListHead">
             	<%= sort_header_tag('name', :caption => l(:label_project)) %>
             	<th><%=l(:field_description)%></th>
             	<th><%=l(:field_is_public)%></th>
             	<th><%=l(:label_subproject_plural)%></th>
             	<%= sort_header_tag('created_on', :caption => l(:field_created_on)) %>
               <th></th>
               </tr>
             <% for project in @projects %>
               <tr class="<%= cycle("odd", "even") %>">
             	<td><%= link_to project.name, :controller => 'projects', :action => 'settings', :id => project %>
-            	<td><%= project.description %>
+            	<td><%=h project.description %>
             	<td align="center"><%= image_tag 'true' if project.is_public? %>
             	<td align="center"><%= project.projects_count %>
             	<td align="center"><%= format_date(project.created_on) %>
               <td align="center">
                 <%= button_to l(:button_delete), { :controller => 'projects', :action => 'destroy', :id => project }, :class => "button-small" %>
               </td>
               </tr>
             <% end %>
             </table>
             <p><%= pagination_links_full @project_pages %>
             [ <%= @project_pages.current.first_item %> - <%= @project_pages.current.last_item %> / <%= @project_count %> ]</p>

app/views/issues/_history.rhtml +1 -1

             <% for journal in journals %>
             	<h4><%= format_time(journal.created_on) %> - <%= journal.user.name %></h4>
             	<ul>
             	<% for detail in journal.details %>
             	   <li><%= show_detail(detail) %></li>
             	<% end %>
             	</ul>
             	<% if journal.notes? %>
-                	<%= simple_format auto_link journal.notes %>
+                	<%= simple_format auto_link h(journal.notes) %>
             	<% end %>
             <% end %>

app/views/issues/_list_simple.rhtml +1 -1

             <% if issues.length > 0 %>
             <table cellspacing="0" cellpadding="1" width="100%" border="0" class="listTable">
             	<tr><td>
             	<table class="listTableContent">
             		<tr class="ListHead">
             		<th>#</th>
             		<th><%=l(:field_tracker)%></th>
             		<th><%=l(:field_subject)%></th>
             		</tr>
             		<% for issue in issues %>
             		<tr class="<%= cycle("odd", "even") %>">
             			<td align="center" style="font-weight:bold;color:#<%= issue.status.html_color %>;">
             				<%= link_to issue.id, :controller => 'issues', :action => 'show', :id => issue %><br />
             			</td>
             			<td><p class="small"><%= issue.project.name %> - <%= issue.tracker.name %><br />
                             <%= issue.status.name %> - <%= format_time(issue.updated_on) %></p></td>
             			<td>
-                            <p class="small"><%= link_to issue.subject, :controller => 'issues', :action => 'show', :id => issue %></p>
+                            <p class="small"><%= link_to h(issue.subject), :controller => 'issues', :action => 'show', :id => issue %></p>
                         </td>
             		</tr>
             		<% end %>
             	</table>
             	</td>
             	</tr>
             </table>
             <% else %>
             	<i><%=l(:label_no_data)%></i>
             <% end %>

app/views/issues/change_status.rhtml +1 -1

-            <h2><%=l(:label_issue)%> #<%= @issue.id %>: <%= @issue.subject %></h2>
+            <h2><%=l(:label_issue)%> #<%= @issue.id %>: <%=h @issue.subject %></h2>
             <%= error_messages_for 'issue' %>
             <%= start_form_tag({:action => 'change_status', :id => @issue}, :class => "tabular") %>
             <%= hidden_field_tag 'confirm', 1 %>
             <%= hidden_field_tag 'new_status_id', @new_status.id %>
             <div class="box">
             <p><label><%=l(:label_issue_status_new)%></label> <%= @new_status.name %></p>
             <p><label for="issue_assigned_to_id"><%=l(:field_assigned_to)%></label>
             <select name="issue[assigned_to_id]">
             <option value=""></option>
             <%= options_from_collection_for_select @assignable_to, "id", "display_name", @issue.assigned_to_id %></p>
             </select></p>
             <p><label for="issue_done_ratio"><%=l(:field_done_ratio)%></label>
             <%= select("issue", "done_ratio", ((0..10).to_a.collect {|r| ["#{r*10} %", r*10] }) ) %>
             </select></p>
             <p><label for="issue_fixed_version"><%=l(:field_fixed_version)%></label>
             <select name="issue[fixed_version_id]">
             <option value="">--none--</option>
             <%= options_from_collection_for_select @issue.project.versions, "id", "name", @issue.fixed_version_id %>
             </select></p>
             <p><label for="notes"><%= l(:field_notes) %></label>
             <%= text_area_tag 'notes', @notes, :cols => 60, :rows => 10 %></p>
             </div>
             <%= hidden_field 'issue', 'lock_version' %>
             <%= submit_tag l(:button_save) %>
             <%= end_form_tag %>

app/views/issues/show.rhtml +3 -3

             <div class="contextual">
             <%= l(:label_export_to) %><%= link_to 'PDF', {:action => 'export_pdf', :id => @issue}, :class => 'pic picPdf' %>
             </div>
-            <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%= @issue.subject %></h2>
+            <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%=h @issue.subject %></h2>
             <div class="box">
             <table width="100%">
             <tr>
                 <td width="15%"><b><%=l(:field_status)%> :</b></td><td width="35%"><%= @issue.status.name %></td>
                 <td width="15%"><b><%=l(:field_priority)%> :</b></td><td width="35%"><%= @issue.priority.name %></td>
             </tr>
             <tr>
                 <td><b><%=l(:field_assigned_to)%> :</b></td><td><%= @issue.assigned_to ? @issue.assigned_to.name : "-" %></td>
-                <td><b><%=l(:field_category)%> :</b></td><td><%= @issue.category ? @issue.category.name : "-" %></td>
+                <td><b><%=l(:field_category)%> :</b></td><td><%=h @issue.category ? @issue.category.name : "-" %></td>
             </tr>
             <tr>
                 <td><b><%=l(:field_author)%> :</b></td><td><%= link_to_user @issue.author %></td>
                 <td><b><%=l(:field_start_date)%> :</b></td><td><%= format_date(@issue.start_date) %></td>
             </tr>
             <tr>
                 <td><b><%=l(:field_created_on)%> :</b></td><td><%= format_date(@issue.created_on) %></td>
                 <td><b><%=l(:field_due_date)%> :</b></td><td><%= format_date(@issue.due_date) %></td>
             </tr>
             <tr>
                 <td><b><%=l(:field_updated_on)%> :</b></td><td><%= format_date(@issue.updated_on) %></td>
                 <td><b><%=l(:field_done_ratio)%> :</b></td><td><%= @issue.done_ratio %> %</td>
             </tr>
             <tr>
             <% n = 0
             for custom_value in @custom_values %>
-                <td><b><%= custom_value.custom_field.name %> :</b></td><td><%= show_value custom_value %></td>
+                <td><b><%= custom_value.custom_field.name %> :</b></td><td><%=h show_value custom_value %></td>
             <% n = n + 1
                if (n > 1)
                     n = 0 %>
                     </tr><tr>
              <%end
             end %>
             </tr>
             </table>
             <hr />
             <br />
             <b><%=l(:field_description)%> :</b><br /><br />
             <%= textilizable @issue.description %>
             <br />
             <div class="contextual">
             <%= link_to_if_authorized l(:button_edit), {:controller => 'issues', :action => 'edit', :id => @issue}, :class => 'pic picEdit' %>
             <%= link_to_if_authorized l(:button_move), {:controller => 'projects', :action => 'move_issues', :id => @project, "issue_ids[]" => @issue.id }, :class => 'pic picMove' %>
             <%= link_to_if_authorized l(:button_delete), {:controller => 'issues', :action => 'destroy', :id => @issue}, :confirm => l(:text_are_you_sure), :post => true, :class => 'pic picDelete' %>
             </div>
             <% if authorize_for('issues', 'change_status') and @status_options and !@status_options.empty? %>
               <%= start_form_tag ({:controller => 'issues', :action => 'change_status', :id => @issue}) %>
               <%=l(:label_change_status)%> :
               <select name="new_status_id">
               <%= options_from_collection_for_select @status_options, "id", "name" %>
               </select>
               <%= submit_tag l(:button_change) %>
               <%= end_form_tag %>
             <% end %>
             </div>
             <div id="history" class="box">
             <h3><%=l(:label_history)%>
             <% if @journals_count > @journals.length %>(<%= l(:label_last_changes, @journals.length) %>)<% end %></h3>
             <%= render :partial => 'history', :locals => { :journals => @journals } %>
             <% if @journals_count > @journals.length %>
                 <p><center><small>[ <%= link_to l(:label_change_view_all), :action => 'history', :id => @issue %> ]</small></center></p>
             <% end %>
             </div>
             <div class="box">
             <h3><%=l(:label_attachment_plural)%></h3>
             <table width="100%">
             <% for attachment in @issue.attachments %>
             <tr>
             <td><%= image_tag('attachment') %> <%= link_to attachment.filename, :action => 'download', :id => @issue, :attachment_id => attachment %> (<%= human_size(attachment.filesize) %>)</td>
             <td><%= format_date(attachment.created_on) %></td>
             <td><%= attachment.author.display_name %></td>
             <% if authorize_for('issues', 'destroy_attachment') %>
               <td>
               <%= start_form_tag :action => 'destroy_attachment', :id => @issue, :attachment_id => attachment %>
               <%= submit_tag l(:button_delete), :class => "button-small" %>
               <%= end_form_tag %>
               </td>
             <% end %>
             </tr>
             <% end %>
             </table>
             <br />
             <% if authorize_for('issues', 'add_attachment') %>
               <%= start_form_tag ({ :controller => 'issues', :action => 'add_attachment', :id => @issue }, :multipart => true, :class => "tabular") %>
               <p id="attachments_p"><label><%=l(:label_attachment_new)%>&nbsp;
               <%= link_to_function image_tag('add'), "addFileField()" %></label>
               <%= file_field_tag 'attachments[]', :size => 30  %></p>
               <%= submit_tag l(:button_add) %>
               <%= end_form_tag %>
             <% end %>
             </div>
             <% if authorize_for('issues', 'add_note') %>
               <div class="box">
               <h3><%= l(:label_add_note) %></h3>
               <%= start_form_tag ({:controller => 'issues', :action => 'add_note', :id => @issue}, :class => "tabular" ) %>
               <p><label for="notes"><%=l(:field_notes)%></label>
                 <%= text_area_tag 'notes', '', :cols => 60, :rows => 10  %></p>
               <%= submit_tag l(:button_add) %>
               <%= end_form_tag %>
               </div>
             <% end %>

app/views/my/blocks/_calendar.rhtml +1 -1

             <h3><%= l(:label_calendar) %></h3>
             <%
             @date_from = Date.today - (Date.today.cwday-1)
             @date_to = Date.today + (7-Date.today.cwday)
             @issues = Issue.find :all,
                                  :conditions => ["issues.project_id in (#{@user.projects.collect{|m| m.id}.join(',')}) AND ((start_date>=? and start_date<=?) or (due_date>=? and due_date<=?))", @date_from, @date_to, @date_from, @date_to],
                                  :include => [:project, :tracker]  unless @user.projects.empty?
             @issues ||= []
             %>
             <table class="calenderTable">
             <tr class="ListHead">
             <td></td>
             <% 1.upto(7) do |d| %>
                 <td align="center" width="14%"><%= day_name(d) %></td>
             <% end %>
             </tr>
             <tr height="100">
             <% day = @date_from
             while day <= @date_to
             	if day.cwday == 1 %>
             	<td valign="middle"><%= day.cweek %></td>
             	<% end %>
             	<td valign="top" width="14%" class="<%= day.month==@month ? "even" : "odd" %>">
             	<p align="right"><%= day==Date.today ? "<b>#{day.day}</b>" : day.day %></p>
             	<% day_issues = []
             	@issues.each { |i| day_issues << i if i.start_date == day or i.due_date == day }
             	day_issues.each do |i| %>
             		<%= if day == i.start_date and day == i.due_date
             		    image_tag('arrow_bw')
             		elsif day == i.start_date
             		    image_tag('arrow_from')
             		elsif day == i.due_date
             		    image_tag('arrow_to')
             		end %>
-            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
+            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
             	<% end %>
                 </td>
             	<%= '</tr><tr height="100">' if day.cwday >= 7 and day!=@date_to %>
             	<%
             	day = day + 1
             end %>
             </tr>
             </table>

app/views/my/blocks/_documents.rhtml +3 -11

@@ -1,15 +1,7
1	<h3><%=l(:label_document_plural)%></h3>	1	<h3><%=l(:label_document_plural)%></h3>
2		2
3	<ul>	3	<%= render(:partial => 'documents/document',
4	<% for document in Document.find :all,	4	:collection => Document.find(:all,
5	:limit => 10,	5	:limit => 10,
6	:conditions => "documents.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",	6	:conditions => "documents.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",
7	:include => [:project] %>	7	:include => [:project])) unless @user.projects.empty? %> No newline at end of file
8	<li>
9	<b><%= link_to document.title, :controller => 'documents', :action => 'show', :id => document %></b>
10	<br />
11	<%= truncate document.description, 150 %><br />
12	<em><%= format_time(document.created_on) %></em><br />
13	</li>
14	<% end unless @user.projects.empty? %>
15	</ul> No newline at end of file

app/views/my/blocks/_latest_news.rhtml +5 -11

@@ -1,13 +1,7
1	<h3><%=l(:label_news_latest)%></h3>	1	<h3><%=l(:label_news_latest)%></h3>
2		2
3	<ul>	3	<%= render (:partial => 'news/news',
4	<% for news in News.find :all,	4	:collection => News.find(:all,
5	:limit => 10,	5	:limit => 10,
6	:conditions => "news.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",	6	:conditions => "news.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",
7	:include => [:project, :author] %>	7	:include => [:project, :author])) unless @user.projects.empty? %> No newline at end of file
8	<li><%= link_to news.title, :controller => 'news', :action => 'show', :id => news %><br />
9	<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
10	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />
11	</li>
12	<% end unless @user.projects.empty? %>
13	</ul> No newline at end of file

app/views/my/page.rhtml +4 -4

-            <h2><%=l(:label_my_page)%></h2>
+            <div class="contextual">
+                <%= link_to l(:label_personalize_page), :action => 'page_layout' %>
-            <div class="topright">
-                <small><%= link_to l(:label_personalize_page), :action => 'page_layout' %></small>
             </div>
+            <h2><%=l(:label_my_page)%></h2>
             <div id="list-top">
             	<% @blocks['top'].each do |b| %>
             	<div class="mypage-box">
             		<%= render :partial => "my/blocks/#{b}", :locals => { :user => @user } %>
             	</div>
             	<% end if @blocks['top'] %>
             </div>
             <div id="list-left" class="splitcontentleft">
             	<% @blocks['left'].each do |b| %>
             	<div class="mypage-box">
             		<%= render :partial => "my/blocks/#{b}", :locals => { :user => @user } %>
             	</div>
             	<% end if @blocks['left'] %>
             </div>
             <div id="list-right" class="splitcontentright">
             	<% @blocks['right'].each do |b| %>
             	<div class="mypage-box">
             		<%= render :partial => "my/blocks/#{b}", :locals => { :user => @user } %>
             	</div>
             	<% end if @blocks['right'] %>
             </div>

app/views/my/page_layout.rhtml +4 -12

             <script language="JavaScript">
             function recreateSortables() {
                 Sortable.destroy('list-top');
                 Sortable.destroy('list-left');
                 Sortable.destroy('list-right');
             	Sortable.create("list-top", {constraint:false, containment:['list-top','list-left','list-right'], dropOnEmpty:true, handle:'handle', onUpdate:function(){new Ajax.Request('/my/order_blocks?group=top', {asynchronous:true, evalScripts:true, onComplete:function(request){new Effect.Highlight("list-top",{});}, onLoaded:function(request){Element.hide('indicator')}, onLoading:function(request){Element.show('indicator')}, parameters:Sortable.serialize("list-top")})}, only:'mypage-box', tag:'div'})
             	Sortable.create("list-left", {constraint:false, containment:['list-top','list-left','list-right'], dropOnEmpty:true, handle:'handle', onUpdate:function(){new Ajax.Request('/my/order_blocks?group=left', {asynchronous:true, evalScripts:true, onComplete:function(request){new Effect.Highlight("list-left",{});}, onLoaded:function(request){Element.hide('indicator')}, onLoading:function(request){Element.show('indicator')}, parameters:Sortable.serialize("list-left")})}, only:'mypage-box', tag:'div'})
             	Sortable.create("list-right", {constraint:false, containment:['list-top','list-left','list-right'], dropOnEmpty:true, handle:'handle', onUpdate:function(){new Ajax.Request('/my/order_blocks?group=right', {asynchronous:true, evalScripts:true, onComplete:function(request){new Effect.Highlight("list-right",{});}, onLoaded:function(request){Element.hide('indicator')}, onLoading:function(request){Element.show('indicator')}, parameters:Sortable.serialize("list-right")})}, only:'mypage-box', tag:'div'})
             }
             function updateSelect() {
                 s = $('block-select')
                 for (var i = 0; i < s.options.length; i++) {
                     if ($('block_' + s.options[i].value)) {
                         s.options[i].disabled = true;
                     } else {
                         s.options[i].disabled = false;
                     }
                 }
                 s.options[0].selected = true;
             }
             function afterAddBlock() {
                 recreateSortables();
                 updateSelect();
             }
             function removeBlock(block) {
                 $(block).parentNode.removeChild($(block));
                 updateSelect();
             }
             </script>
-            <div style="float:right;">
+            <div class="contextual">
+            <span id="indicator" style="display:none"><%= image_tag "loading.gif", :align => "absmiddle" %></span>
             <%= start_form_tag({:action => "add_block"}, :id => "block-form") %>
+            <%= select_tag 'block', "<option></option>" + options_for_select(@block_options), :id => "block-select" %>
-            <%= select_tag 'block', "<option></option>" + options_for_select(@block_options), :id => "block-select", :class => "select-small" %>
-            <small>
             <%= link_to_remote l(:button_add),
                         :url => { :action => "add_block" },
                         :with => "Form.serialize('block-form')",
                         :update => "list-top",
                         :position => :top,
                         :complete => "afterAddBlock();",
                         :loading => "Element.show('indicator')",
                         :loaded => "Element.hide('indicator')"
                          %>
-            </small>
+            <%= end_form_tag %> |
-            <%= end_form_tag %>
-            <small>|
             <%= link_to l(:button_save), :action => 'page_layout_save' %> |
             <%= link_to l(:button_cancel), :action => 'page' %>
-            </small>
-            </div>
-            <div style="float:right;margin-right:20px;">
-            <span id="indicator" style="display:none"><%= image_tag "loading.gif" %></span>
             </div>
             <h2><%=l(:label_my_page)%></h2>
             <div id="list-top" class="block-receiver">
             	<% @blocks['top'].each do |b| %>
             	<%= render :partial => 'block', :locals => {:user => @user, :block_name => b} %>
             	<% end if @blocks['top'] %>
             </div>
             <div id="list-left" class="splitcontentleft block-receiver">
             	<% @blocks['left'].each do |b| %>
             	<%= render :partial => 'block', :locals => {:user => @user, :block_name => b} %>
             	<% end if @blocks['left'] %>
             </div>
             <div id="list-right" class="splitcontentright block-receiver">
             	<% @blocks['right'].each do |b| %>
             	<%= render :partial => 'block', :locals => {:user => @user, :block_name => b} %>
             	<% end if @blocks['right'] %>
             </div>
             <%= sortable_element 'list-top',
                   :tag => 'div',
                   :only => 'mypage-box',
                   :handle => "handle",
                   :dropOnEmpty => true,
                   :containment => ['list-top', 'list-left', 'list-right'],
                   :constraint => false,
                   :complete => visual_effect(:highlight, 'list-top'),
                   :url => { :action => "order_blocks", :group => "top" },
                   :loading => "Element.show('indicator')",
                   :loaded => "Element.hide('indicator')"
                    %>
             <%= sortable_element 'list-left',
                   :tag => 'div',
                   :only => 'mypage-box',
                   :handle => "handle",
                   :dropOnEmpty => true,
                   :containment => ['list-top', 'list-left', 'list-right'],
                   :constraint => false,
                   :complete => visual_effect(:highlight, 'list-left'),
                   :url => { :action => "order_blocks", :group => "left" },
                   :loading => "Element.show('indicator')",
                   :loaded => "Element.hide('indicator')" %>
             <%= sortable_element 'list-right',
                   :tag => 'div',
                   :only => 'mypage-box',
                   :handle => "handle",
                   :dropOnEmpty => true,
                   :containment => ['list-top', 'list-left', 'list-right'],
                   :constraint => false,
                   :complete => visual_effect(:highlight, 'list-right'),
                   :url => { :action => "order_blocks", :group => "right" },
                   :loading => "Element.show('indicator')",
                   :loaded => "Element.hide('indicator')" %>
             <%= javascript_tag "updateSelect()" %>

app/views/news/show.rhtml +2 -2

             <div class="contextual">
             <%= link_to_if_authorized l(:button_edit), {:controller => 'news', :action => 'edit', :id => @news}, :class => 'pic picEdit' %>
             <%= link_to_if_authorized l(:button_delete), {:controller => 'news', :action => 'destroy', :id => @news}, :confirm => l(:text_are_you_sure), :post => true, :class => 'pic picDelete' %>
             </div>
-            <h2><%= @news.title %></h2>
+            <h2><%=h @news.title %></h2>
-            <p><em><%= @news.summary %><br />
+            <p><em><%=h @news.summary %><br />
             <%= @news.author.display_name %>, <%= format_time(@news.created_on) %></em></p>
             <br />
             <%= textilizable auto_link @news.description %>
             <br />
             <div id="comments" style="margin-bottom:16px;">
             <h3><%= l(:label_comment_plural) %></h3>
             <% @news.comments.each do |comment| %>
                 <% next if comment.new_record? %>
                 <h4><%= format_time(comment.created_on) %> - <%= comment.author.name %></h4>
                 <div class="contextual">
                     <%= link_to_if_authorized l(:button_delete), {:controller => 'news', :action => 'destroy_comment', :id => @news, :comment_id => comment}, :confirm => l(:text_are_you_sure), :post => true, :class => 'pic picDelete' %>
                 </div>
                 <%= simple_format(auto_link(h comment.comment))%>
             <% end if @news.comments_count > 0 %>
             </div>
             <% if authorize_for 'news', 'add_comment' %>
             <h3><%= l(:label_comment_add) %></h3>
             <%= start_form_tag :action => 'add_comment', :id => @news %>
             <%= error_messages_for 'comment' %>
             <p><label for="comment_comment"><%= l(:field_comment) %></label><br />
             <%= text_area 'comment', 'comment', :cols => 60, :rows => 6 %></p>
             <%= submit_tag l(:button_add) %>
             <%= end_form_tag %>
             <% end %>

app/views/projects/activity.rhtml +6 -6

             <h2><%=l(:label_activity)%>: <%= "#{month_name(@month).downcase} #{@year}" %></h2>
             <div>
             <div class="rightbox">
               <%= start_form_tag %>
             <p><%= select_month(@month, :prefix => "month", :discard_type => true) %>
             <%= select_year(@year, :prefix => "year", :discard_type => true) %></p>
                 <%= check_box_tag 'show_issues', 1, @show_issues %><%= hidden_field_tag 'show_issues', 0 %> <%=l(:label_issue_plural)%><br />
                 <%= check_box_tag 'show_news', 1, @show_news %><%= hidden_field_tag 'show_news', 0 %> <%=l(:label_news_plural)%><br />
                 <%= check_box_tag 'show_files', 1, @show_files %><%= hidden_field_tag 'show_files', 0 %> <%=l(:label_attachment_plural)%><br />
                 <%= check_box_tag 'show_documents', 1, @show_documents %><%= hidden_field_tag 'show_documents', 0 %> <%=l(:label_document_plural)%><br />
                 <p><center><%= submit_tag l(:button_apply), :class => 'button-small' %></center></p>
               <%= end_form_tag %>
               </div>
             <% @events_by_day.keys.sort {|x,y| y <=> x }.each do |day| %>
               <h3><%= day_name(day.cwday) %> <%= day.day %></h3>
               <ul>
               <% @events_by_day[day].sort {|x,y| y.created_on <=> x.created_on }.each do |e| %>
                 <li><p>
                 <% if e.is_a? Issue %>
-                  <%= e.created_on.strftime("%H:%M") %> <%= link_to "#{e.tracker.name} ##{e.id}", :controller => 'issues', :action => 'show', :id => e %> (<%= e.status.name %>): <%= e.subject %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%= link_to "#{e.tracker.name} ##{e.id}", :controller => 'issues', :action => 'show', :id => e %> (<%= e.status.name %>): <%=h e.subject %><br />
                       <i><%= e.author.name %></i>
                 <% elsif e.is_a? News %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_news)%>: <%= link_to e.title, :controller => 'news', :action => 'show', :id => e %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_news)%>: <%= link_to h(e.title), :controller => 'news', :action => 'show', :id => e %><br />
-                      <% unless e.summary.empty? %><%= e.summary %><br /><% end %>
+                      <% unless e.summary.empty? %><%=h e.summary %><br /><% end %>
                       <i><%= e.author.name %></i>
                 <% elsif (e.is_a? Attachment) and (e.container.is_a? Version) %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%> (<%= e.container.name %>): <%= link_to e.filename, :controller => 'projects', :action => 'list_files', :id => @project %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%> (<%=h e.container.name %>): <%= link_to e.filename, :controller => 'projects', :action => 'list_files', :id => @project %><br />
                     <i><%= e.author.name %></i>
                 <% elsif (e.is_a? Attachment) and (e.container.is_a? Document) %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%>: <%= e.filename %> (<%= link_to e.container.title, :controller => 'documents', :action => 'show', :id => e.container %>)<br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%>: <%= e.filename %> (<%= link_to h(e.container.title), :controller => 'documents', :action => 'show', :id => e.container %>)<br />
                     <i><%= e.author.name %></i>
                 <% elsif e.is_a? Document %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_document)%>: <%= link_to e.title, :controller => 'documents', :action => 'show', :id => e %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_document)%>: <%= link_to h(e.title), :controller => 'documents', :action => 'show', :id => e %><br />
                 <% end %>
                 </p></li>
               <% end %>
               </ul>
             <% end %>
             <% if @events_by_day.empty? %><p><i><%= l(:label_no_data) %></i></p><% end %>
             <div style="float:left;">
             <%= link_to_remote ('&#171; ' + (@month==1 ? "#{month_name(12)} #{@year-1}" : "#{month_name(@month-1)}")),
                                 {:update => "content", :url => { :year => (@month==1 ? @year-1 : @year), :month =>(@month==1 ? 12 : @month-1) }},
                                 {:href => url_for(:action => 'activity', :year => (@month==1 ? @year-1 : @year), :month =>(@month==1 ? 12 : @month-1))}
                                 %>
             </div>
             <div style="float:right;">
             <%= link_to_remote ((@month==12 ? "#{month_name(1)} #{@year+1}" : "#{month_name(@month+1)}") + ' &#187;'),
                                 {:update => "content", :url => { :year => (@month==12 ? @year+1 : @year), :month =>(@month==12 ? 1 : @month+1) }},
                                 {:href => url_for(:action => 'activity', :year => (@month==12 ? @year+1 : @year), :month =>(@month==12 ? 1 : @month+1))}
                                 %>&nbsp;
             </div>
             <br />
             </div>

app/views/projects/calendar.rhtml +1 -1

             <h2><%= l(:label_calendar) %></h2>
             <table width="100%">
             <tr>
             <td align="left" width="150">
                 <%= link_to_remote ('&#171; ' + (@month==1 ? "#{month_name(12)} #{@year-1}" : "#{month_name(@month-1)}")),
                                     {:update => "content", :url => { :year => (@month==1 ? @year-1 : @year), :month =>(@month==1 ? 12 : @month-1) }},
                                     {:href => url_for(:action => 'calendar', :year => (@month==1 ? @year-1 : @year), :month =>(@month==1 ? 12 : @month-1))}
                                     %>
             </td>
             <td align="center">
                 <%= start_form_tag :action => 'calendar', :id => @project %>
                 <%= select_month(@month, :prefix => "month", :discard_type => true) %>
                 <%= select_year(@year, :prefix => "year", :discard_type => true) %>
                 <%= submit_tag l(:button_submit), :class => "button-small" %>
                 <%= end_form_tag %>
             </td>
             <td align="right" width="150">
                 <%= link_to_remote ((@month==12 ? "#{month_name(1)} #{@year+1}" : "#{month_name(@month+1)}") + ' &#187;'),
                                     {:update => "content", :url => { :year => (@month==12 ? @year+1 : @year), :month =>(@month==12 ? 1 : @month+1) }},
                                     {:href => url_for(:action => 'calendar', :year => (@month==12 ? @year+1 : @year), :month =>(@month==12 ? 1 : @month+1))}
                                     %>&nbsp;
             </td>
             </tr>
             </table>
             <br />
             <table class="calenderTable">
             <tr class="ListHead">
             <td></td>
             <% 1.upto(7) do |d| %>
                 <td align="center" width="14%"><%= day_name(d) %></td>
             <% end %>
             </tr>
             <tr height="100">
             <% day = @date_from
             while day <= @date_to
             	if day.cwday == 1 %>
             	<td valign="middle"><%= day.cweek %></td>
             	<% end %>
             	<td valign="top" width="14%" class="<%= day.month==@month ? "even" : "odd" %>">
             	<p align="right"><%= day==Date.today ? "<b>#{day.day}</b>" : day.day %></p>
             	<% day_issues = []
             	@issues.each { |i| day_issues << i if i.start_date == day or i.due_date == day }
             	day_issues.each do |i| %>
             		<%= if day == i.start_date and day == i.due_date
             		    image_tag('arrow_bw')
             		elsif day == i.start_date
             		    image_tag('arrow_from')
             		elsif day == i.due_date
             		    image_tag('arrow_to')
             		end %>
-            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
+            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
             	<% end %>
                 </td>
             	<%= '</tr><tr height="100">' if day.cwday >= 7 and day!=@date_to %>
             	<%
             	day = day + 1
             end %>
             </tr>
             </table>
             <br />
             <%= image_tag 'arrow_from' %>&nbsp;&nbsp;<%= l(:text_tip_task_begin_day) %><br />
             <%= image_tag 'arrow_to' %>&nbsp;&nbsp;<%= l(:text_tip_task_end_day) %><br />
             <%= image_tag 'arrow_bw' %>&nbsp;&nbsp;<%= l(:text_tip_task_begin_end_day) %><br />

app/views/projects/changelog.rhtml +1 -1

             <h2><%=l(:label_change_log)%></h2>
             <div>
             <div class="rightbox" style="width:140px;">
             <%= start_form_tag %>
             <strong><%=l(:label_tracker_plural)%></strong><br />
             <% @trackers.each do |tracker| %>
               <%= check_box_tag "tracker_ids[]", tracker.id, (@selected_tracker_ids.include? tracker.id.to_s) %>
               <%= tracker.name %><br />
             <% end %>
             <p><center><%= submit_tag l(:button_apply), :class => 'button-small' %></center></p>
             <%= end_form_tag %>
             </div>
             <% ver_id = nil
                @fixed_issues.each do |issue| %>
                 <% unless ver_id == issue.fixed_version_id %>
                 <% if ver_id %></ul><% end %>
                 <h3><%= l(:label_version) %>: <%= issue.fixed_version.name %></h3>
                 <p><%= format_date(issue.fixed_version.effective_date) %><br />
                 <%=h issue.fixed_version.description %></p>
                 <ul>
                 <% ver_id = issue.fixed_version_id
                 end %>
-                <li><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %> [<%= issue.tracker.name %>]: <%= issue.subject %></li>
+                <li><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %> [<%= issue.tracker.name %>]: <%=h issue.subject %></li>
             <% end %>
             </div>

app/views/projects/export_issues_pdf.rfpdf +1 -2

             <%	pdf=IfpdfHelper::IFPDF.new
             	pdf.AliasNbPages
             	pdf.footer_date = format_date(Date.today)
-            	pdf.AddPage
             	@issues.each {|i|
-            		render :partial => 'issues/pdf', :locals => { :pdf => pdf, :issue => i }
             		pdf.AddPage
+            		render :partial => 'issues/pdf', :locals => { :pdf => pdf, :issue => i }
             	}
             %>
             <%= pdf.Output %>

app/views/projects/gantt.rhtml +1 -1

             <div class="contextual">
             <%= l(:label_export_to) %>
             <%= link_to 'PDF', {:zoom => @zoom, :year => @year_from, :month => @month_from, :months => @months, :output => 'pdf'}, :class => 'pic picPdf' %>
             </div>
             <h2><%= l(:label_gantt) %></h2>
             <table width="100%">
             <tr>
             <td align="left">
             <%= start_form_tag %>
             <input type="text" name="months" size="2" value="<%= @months %>">
             <%= l(:label_months_from) %>
             <%= select_month(@month_from, :prefix => "month", :discard_type => true) %>
             <%= select_year(@year_from, :prefix => "year", :discard_type => true) %>
             <%= hidden_field_tag 'zoom', @zoom %>
             <%= submit_tag l(:button_submit), :class => "button-small" %>
             <%= end_form_tag %>
             </td>
             <td align="right">
             <%= if @zoom < 4
                 link_to image_tag('zoom_in'), {:zoom => (@zoom+1), :year => @year_from, :month => @month_from, :months => @months}
               else
                 image_tag 'zoom_in_g'
               end %>
             <%= if @zoom > 1
                 link_to image_tag('zoom_out'), :zoom => (@zoom-1), :year => @year_from, :month => @month_from, :months => @months
               else
                 image_tag 'zoom_out_g'
               end %>
             </td>
             </tr>
             </table>
             <br />
             <style>
             .m_bg {
               position:absolute;
               top:0;
               height:16px;
               border-top: 1px solid #c0c0c0;
               border-bottom: 1px solid #c0c0c0;
               border-right: 1px solid #c0c0c0;
               text-align: center;
             }
             .task {
               position: absolute;
               height:8px;
               font-size:0.8em;
               color:#888;
               background:#aaa;
               padding:0;
               margin:0;
               line-height:0.8em;
             }
             .task_late {
               background:#f66;
             }
             .task_done {
               background:#66f;
             }
             </style>
             <% zoom = 1
             @zoom.times { zoom = zoom * 2 }
             subject_width = 260
             header_heigth = 18
             headers_heigth = header_heigth
             show_weeks = false
             show_days = false
             if @zoom >1
                 show_weeks = true
                 headers_heigth = 2*header_heigth
                 if @zoom > 2
                     show_days = true
                     headers_heigth = 3*header_heigth
                 end
             end
             g_width = (@date_to - @date_from + 1)*zoom
             g_height = [(20 * @issues.length + 6), 206].max
             t_height = g_height + headers_heigth
             %>
             <table width="100%" border=0 cellspacing=0 cellpading=0>
             <tr>
             <td width=260>
             <div style="position:relative;height:<%= t_height + 24 %>px;width:<%= subject_width + 1 %>px;">
             <div style="right:-2px;width:<%= subject_width %>px;height:<%= headers_heigth %>px;" class="m_bg"></div>
             <div style="right:-2px;width:<%= subject_width %>px;height:<%= t_height %>px;border-left: 1px solid #c0c0c0;" class="m_bg"></div>
             <%
             #
             # Tasks subjects
             #
             top = headers_heigth + 8
             @issues.each do |i| %>
             	<div style="position: absolute;line-height:1em;height:16px;top:<%= top %>px;left:4px;width:<%= subject_width - 5 %>px;overflow:hidden;">
             	<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>:
-            	<%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small>
+            	<%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small>
             	</div>
             <% top = top + 20
             end %>
             </div>
             </td>
             <td>
             <div style="position:relative;height:<%= t_height + 24 %>px;width:<%= subject_width %>;overflow:auto;">
             <div style="width:<%= g_width-1 %>px;height:<%= headers_heigth %>px;" class="m_bg">&nbsp;</div>
             <%
             #
             # Months headers
             #
             month_f = @date_from
             left = 0
             height = (show_weeks ? header_heigth : header_heigth + g_height)
             @months.times do
             	width = ((month_f >> 1) - month_f) * zoom - 1
             	%>
             	<div style="left:<%= left %>px;width:<%= width %>px;height:<%= height %>px;" class="m_bg">
             	<%= link_to "#{month_f.year}-#{month_f.month}", :year => month_f.year, :month => month_f.month, :zoom => @zoom, :months => @months %>
             	</div>
             	<%
             	left = left + width + 1
             	month_f = month_f >> 1
             end %>
             <%
             #
             # Weeks headers
             #
             if show_weeks
             	left = 0
             	height = (show_days ? header_heigth-1 : header_heigth-1 + g_height)
             	if @date_from.cwday == 1
             	    # @date_from is monday
                     week_f = @date_from
             	else
             	    # find next monday after @date_from
             		week_f = @date_from + (7 - @date_from.cwday + 1)
             		width = (7 - @date_from.cwday + 1) * zoom-1
             		%>
             		<div style="left:<%= left %>px;top:19px;width:<%= width %>px;height:<%= height %>px;" class="m_bg">&nbsp;</div>
             		<%
             		left = left + width+1
             	end %>
             	<%
             	while week_f < @date_to
             		width = (week_f + 6 <= @date_to) ? 7 * zoom -1 : (@date_to - week_f + 1) * zoom-1
             		%>
             		<div style="left:<%= left %>px;top:19px;width:<%= width %>px;height:<%= height %>px;" class="m_bg">
             		<small><%= week_f.cweek %></small>
             		</div>
             		<%
             		left = left + width+1
             		week_f = week_f+7
             	end
             end %>
             <%
             #
             # Days headers
             #
             if show_days
             	left = 0
             	height = g_height + header_heigth - 1
             	wday = @date_from.cwday
             	(@date_to - @date_from + 1).to_i.times do
             	width =  zoom - 1
             	%>
             	<div style="left:<%= left %>px;top:37px;width:<%= width %>px;height:<%= height %>px;font-size:0.7em;<%= "background:#f1f1f1;" if wday > 5 %>" class="m_bg">
             	<%= day_name(wday)[0,1] %>
             	</div>
             	<%
             	left = left + width+1
             	wday = wday + 1
             	wday = 1 if wday > 7
             	end
             end %>
             <%
             #
             # Today red line
             #
             if Date.today >= @date_from and Date.today <= @date_to %>
                 <div style="position: absolute;height:<%= g_height %>px;top:<%= headers_heigth + 1 %>px;left:<%= ((Date.today-@date_from+1)*zoom).floor()-1 %>px;width:10px;border-left: 1px dashed red;">&nbsp;</div>
             <% end %>
             <%
             #
             # Tasks
             #
             top = headers_heigth + 12
             @issues.each do |i| %>
             	<%
             	i_start_date = (i.start_date >= @date_from ? i.start_date : @date_from )
             	i_end_date = (i.due_date <= @date_to ? i.due_date : @date_to )
             	i_done_date = i.start_date + ((i.due_date - i.start_date+1)*i.done_ratio/100).floor
             	i_done_date = (i_done_date <= @date_from ? @date_from : i_done_date )
             	i_done_date = (i_done_date >= @date_to ? @date_to : i_done_date )
             	i_late_date = [i_end_date, Date.today].min if i_start_date < Date.today
             	i_left = ((i_start_date - @date_from)*zoom).floor
             	i_width = ((i_end_date - i_start_date + 1)*zoom).floor
             	d_width = ((i_done_date - i_start_date)*zoom).floor
             	l_width = ((i_late_date - i_start_date+1)*zoom).floor if i_late_date
             	l_width ||= 0
             	%>
             	<div style="top:<%= top %>px;left:<%= i_left %>px;width:<%= i_width %>px;" class="task">&nbsp;</div>
             	<% if l_width > 0 %>
             	    <div style="top:<%= top %>px;left:<%= i_left %>px;width:<%= l_width %>px;" class="task task_late">&nbsp;</div>
             	<% end %>
             	<% if d_width > 0 %>
             	    <div style="top:<%= top %>px;left:<%= i_left %>px;width:<%= d_width %>px;" class="task task_done">&nbsp;</div>
             	<% end %>
             	<div style="top:<%= top %>px;left:<%= i_left + i_width + 5 %>px;background:#fff;" class="task">
             	<%= i.status.name %>
             	<%= (i.done_ratio).to_i %>%
             	</div>
             	<% top = top + 20
             end %>
             </div>
             </td>
             </tr>
             </table>
             <table width="100%">
             <tr>
             <td align="left"><%= link_to ('&#171; ' + l(:label_previous)), :year => (@date_from << @months).year, :month => (@date_from << @months).month, :zoom => @zoom, :months => @months %></td>
             <td>
             <td align="right"><%= link_to (l(:label_next) + ' &#187;'), :year => (@date_from >> @months).year, :month => (@date_from >> @months).month, :zoom => @zoom, :months => @months %></td>
             </tr>
             </table>

app/views/projects/list.rhtml +1 -1

             <h2><%=l(:label_public_projects)%></h2>
             <table class="listTableContent">
               <tr class="ListHead">
             	<%= sort_header_tag('name', :caption => l(:label_project)) %>
             	<th><%=l(:field_description)%></th>
             	<%= sort_header_tag('created_on', :caption => l(:field_created_on)) %>
               </tr>
             <% for project in @projects %>
               <tr class="<%= cycle("odd", "even") %>">
             	<td><%= link_to project.name, :action => 'show', :id => project %>
-            	<td><%= project.description %>
+            	<td><%=h project.description %>
             	<td align="center"><%= format_date(project.created_on) %>
               </tr>
             <% end %>
             </table>
             <%= pagination_links_full @project_pages %>
             [ <%= @project_pages.current.first_item %> - <%= @project_pages.current.last_item %> / <%= @project_count %> ]

app/views/projects/list_documents.rhtml +2 -12

             <div class="contextual">
             <%= link_to_if_authorized l(:label_document_new), {:controller => 'projects', :action => 'add_document', :id => @project}, :class => 'pic picAdd' %>
             </div>
             <h2><%=l(:label_document_plural)%></h2>
             <% if @documents.empty? %><p><i><%= l(:label_no_data) %></i></p><% end %>
             <% documents = @documents.group_by {|d| d.category } %>
             <% documents.each do |category, docs| %>
-            <h3><%= category.name %></h3>
+                <h3><%= category.name %></h3>
-            <ul>
+                <%= render :partial => 'documents/document', :collection => docs %>
-            <% docs.each do |d| %>
-              <li>
-                <b><%= link_to d.title, :controller => 'documents', :action => 'show', :id => d %></b>
-                <br />
-                <%= truncate d.description, 250 %><br />
-                <em><%= format_time(d.created_on) %></em><br />&nbsp;
-              </li>
-            <% end %>
-            </ul>
             <% end %>

app/views/projects/list_issues.rhtml +1 -1

             <% if @query.new_record? %>
                 <h2><%=l(:label_issue_plural)%></h2>
                 <%= start_form_tag({:action => 'list_issues'}, :id => 'query_form') %>
                 <%= render :partial => 'queries/filters', :locals => {:query => @query} %>
                 <%= end_form_tag %>
                 <div class="contextual">
                 <%= link_to_remote l(:button_apply),
                                    { :url => { :controller => 'projects', :action => 'list_issues', :id => @project, :set_filter => 1 },
                                      :update => "content",
                                      :with => "Form.serialize('query_form')"
                                    }, :class => 'pic picCheck' %>
                 <%= link_to l(:button_clear), {:controller => 'projects', :action => 'list_issues', :id => @project, :set_filter => 1}, :class => 'pic picDelete'  %>
                 <% if authorize_for('projects', 'add_query') %>
                 <%= link_to_remote l(:button_save),
                                    { :url => { :controller => 'projects', :action => "add_query", :id => @project },
                                      :method => 'get',
                                      :update => "content",
                                      :with => "Form.serialize('query_form')"
                                    }, :class => 'pic picEdit' %>
                 <% end %>
                 </div>
                 <br />
             <% else %>
                 <% if authorize_for('projects', 'add_query') %>
                 <div class="contextual">
                     <%= link_to l(:button_edit), {:controller => 'queries', :action => 'edit', :id => @query}, :class => 'pic picEdit' %>
                     <%= link_to l(:button_delete), {:controller => 'queries', :action => 'destroy', :id => @query}, :confirm => l(:text_are_you_sure), :post => true, :class => 'pic picDelete' %>
                 </div>
                 <% end %>
                 <h2><%= @query.name %></h2>
             <% end %>
             <%= error_messages_for 'query' %>
             <% if @query.valid? %>
             <% if @issues.empty? %>
             <p><i><%= l(:label_no_data) %></i></p>
             <% else %>
             &nbsp;
             <table class="listTableContent">
                 <tr>
                 <td colspan="6" align="left"><small><%= check_all_links 'issues_form' %></small></td>
                 <td colspan="2" align="right">
                     <small><%= l(:label_per_page) %>:</small>
                     <%= start_form_tag %>
                     <%= select_tag 'per_page', options_for_select(@results_per_page_options, @results_per_page), :class => 'select-small'%>
                     <%= submit_tag l(:button_apply), :class => 'button-small'%>
                     <%= end_form_tag %>
                 </td>
                 </tr>
             </table>
             <%= start_form_tag({:controller => 'projects', :action => 'move_issues', :id => @project}, :id => 'issues_form' ) %>
             <table class="listTableContent">
                 <tr class="ListHead">
                     <td></td>
             		<%= sort_header_tag('issues.id', :caption => '#') %>
             		<%= sort_header_tag('issue_statuses.name', :caption => l(:field_status)) %>
             		<%= sort_header_tag('issues.tracker_id', :caption => l(:field_tracker)) %>
             		<th><%=l(:field_subject)%></th>
             		<%= sort_header_tag('users.lastname', :caption => l(:field_author)) %>
             		<%= sort_header_tag('issues.created_on', :caption => l(:field_created_on)) %>
             		<%= sort_header_tag('issues.updated_on', :caption => l(:field_updated_on)) %>
             	</tr>
             	<% for issue in @issues %>
             	<tr class="<%= cycle("odd", "even") %>">
             	    <td width="15"><%= check_box_tag "issue_ids[]", issue.id %></td>
             		<td align="center"><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %></td>
             		<td align="center" style="font-weight:bold;color:#<%= issue.status.html_color %>;"><%= issue.status.name %></font></td>
             		<td align="center"><%= issue.tracker.name %></td>
-            		<td><%= link_to issue.subject, :controller => 'issues', :action => 'show', :id => issue %></td>
+            		<td><%= link_to h(issue.subject), :controller => 'issues', :action => 'show', :id => issue %></td>
             		<td align="center"><%= issue.author.display_name %></td>
             		<td align="center"><%= format_time(issue.created_on) %></td>
             		<td align="center"><%= format_time(issue.updated_on) %></td>
             	</tr>
             	<% end %>
             </table>
             <div class="contextual">
             <%= l(:label_export_to) %>
             <%= link_to 'CSV', {:action => 'export_issues_csv', :id => @project}, :class => 'pic picCsv' %>,
             <%= link_to 'PDF', {:action => 'export_issues_pdf', :id => @project}, :class => 'pic picPdf' %>
             </div>
             <p>
             <%= pagination_links_full @issue_pages %>
             [ <%= @issue_pages.current.first_item %> - <%= @issue_pages.current.last_item %> / <%= @issue_count %> ]
             </p>
             <%= submit_tag l(:button_move) %>
             <%= end_form_tag %>
             <% end %>
             <% end %>

app/views/projects/list_news.rhtml +1 -12

@@ -1,20 +1,9
1	<div class="contextual">	1	<div class="contextual">
2	<%= link_to_if_authorized l(:label_news_new), {:controller => 'projects', :action => 'add_news', :id => @project}, :class => 'pic picAdd' %>	2	<%= link_to_if_authorized l(:label_news_new), {:controller => 'projects', :action => 'add_news', :id => @project}, :class => 'pic picAdd' %>
3	</div>	3	</div>
4		4
5	<h2><%=l(:label_news_plural)%></h2>	5	<h2><%=l(:label_news_plural)%></h2>
6		6
7	<% if @news.empty? %><p><i><%= l(:label_no_data) %></i></p><% end %>	7	<% if @news.empty? %><p><i><%= l(:label_no_data) %></i></p><% end %>
8		8	<%= render :partial => 'news/news', :collection => @news %>
9	<ul>
10	<% for news in @news %>
11	<li><%= link_to news.title, :controller => 'news', :action => 'show', :id => news %><br />
12	<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
13	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />
14	<%= news.comments_count %> <%= lwr(:label_comment, news.comments_count).downcase %><br />
15	</li>
16	<% end %>
17	</ul>
18
19
20	<%= pagination_links_full @news_pages %>	9	<%= pagination_links_full @news_pages %>

app/views/projects/show.rhtml +5 -10

             <h2><%=l(:label_overview)%></h2>
             <div class="splitcontentleft">
-            	<%= simple_format(auto_link(@project.description)) %>
+            	<%= simple_format(auto_link(h @project.description)) %>
             	<ul>
             	<% unless @project.homepage.empty? %><li><%=l(:field_homepage)%>: <%= auto_link @project.homepage %></li><% end %>
             	<li><%=l(:field_created_on)%>: <%= format_date(@project.created_on) %></li>
             	<% for custom_value in @custom_values %>
             	<% if !custom_value.value.empty? %>
-            	   <li><%= custom_value.custom_field.name%>: <%= show_value(custom_value) %></li>
+            	   <li><%= custom_value.custom_field.name%>: <%=h show_value(custom_value) %></li>
             	<% end %>
             	<% end %>
             	</ul>
               <div class="box">
                 <h3><%= image_tag "tracker" %> <%=l(:label_tracker_plural)%></h3>
                 <ul>
                 <% for tracker in @trackers %>
                   <li><%= link_to tracker.name, :controller => 'projects', :action => 'list_issues', :id => @project,
                                                             :set_filter => 1,
                                                             "tracker_id" => tracker.id %>:
                   <%= issue_count = Issue.count(:conditions => ["project_id=? and tracker_id=? and issue_statuses.is_closed=?", @project.id, tracker.id, false], :include => :status) %>
                   <%= lwr(:label_open_issues, issue_count) %>
                   </li>
                 <% end %>
                 </ul>
                 <% if authorize_for 'projects', 'add_issue' %>
                     &#187; <%=l(:label_issue_new)%>:
                     <ul>
                     <% @trackers.each do |tracker| %>
                     <li><%= link_to tracker.name, :controller => 'projects', :action => 'add_issue', :id => @project, :tracker_id => tracker %></li>
                     <% end %>
                     </ul>
                 <% end %>
-                <center><small>[ <%= link_to l(:label_issue_view_all), :controller => 'projects', :action => 'list_issues', :id => @project, :set_filter => 1 %> ]</small></center>
+                <center><small><%= link_to l(:label_issue_view_all), :controller => 'projects', :action => 'list_issues', :id => @project, :set_filter => 1 %></small></center>
               </div>
             </div>
             <div class="splitcontentright">
             	<div class="box">
             		<h3><%= image_tag "users" %> <%=l(:label_member_plural)%></h3>
             		<% for member in @members %>
             		<%= link_to_user member.user %> (<%= member.role.name %>)<br />
             		<% end %>
             	</div>
               <% if @subprojects %>
              	<div class="box">
             		<h3><%= image_tag "projects" %> <%=l(:label_subproject_plural)%></h3>
             		<% for subproject in @subprojects %>
             		<%= link_to subproject.name, :action => 'show', :id => subproject %><br />
             		<% end %>
             	</div>
               <% end %>
               <div class="box">
                 <h3><%=l(:label_news_latest)%></h3>
-                <% for news in @news %>
+                <%= render :partial => 'news/news', :collection => @news %>
-                  <p><b><%= news.title %></b> <small>(<%= link_to_user news.author %> <%= format_time(news.created_on) %>)</small><br />
+                <center><small><%= link_to l(:label_news_view_all), :controller => 'projects', :action => 'list_news', :id => @project %></small></center>
-                  <%= news.summary %>
-                  <small>[<%= link_to l(:label_read), :controller => 'news', :action => 'show', :id => news %>]</small></p>
-                  <hr />
-                <% end %>
-                <center><small>[ <%= link_to l(:label_news_view_all), :controller => 'projects', :action => 'list_news', :id => @project %> ]</small></center>
               </div>
             </div>

app/views/users/_form.rhtml +1 -1

             <%= error_messages_for 'user' %>
             <!--[form:user]-->
             <div class="box">
             <h3><%=l(:label_information_plural)%></h3>
             <p><%= f.text_field :login, :required => true, :size => 25  %></p>
             <p><%= f.text_field :firstname, :required => true %></p>
             <p><%= f.text_field :lastname, :required => true %></p>
             <p><%= f.text_field :mail, :required => true %></p>
             <p><%= f.select :language, lang_options_for_select %></p>
             <% for @custom_value in @custom_values %>
             	<p><%= custom_field_tag_with_label @custom_value %></p>
-            <% end %>
+            <% end if @custom_values%>
             <p><%= f.check_box :admin %></p>
             <p><%= f.check_box :mail_notification %></p>
             </div>
             <div class="box">
             <h3><%=l(:label_authentication)%></h3>
             <% unless @auth_sources.empty? %>
             <p><%= f.select :auth_source_id, [[l(:label_internal), ""]] + @auth_sources.collect { |a| [a.name, a.id] } %></p>
             <% end %>
             <p><label for="password"><%=l(:field_password)%><span class="required"> *</span></label>
             <%= password_field_tag 'password', nil, :size => 25  %></p>
             <p><label for="password_confirmation"><%=l(:field_password_confirmation)%><span class="required"> *</span></label>
             <%= password_field_tag 'password_confirmation', nil, :size => 25  %></p>
             </div>
             <!--[eoform:user]-->

app/views/welcome/index.rhtml +2 -9

             <h2><%= $RDM_WELCOME_TITLE || l(:label_home) %></h2>
             <div class="splitcontentleft">
               <% if $RDM_WELCOME_TEXT %><p><%= $RDM_WELCOME_TEXT %></p><br /><% end %>
               <div class="box">
             	<h3><%=l(:label_news_latest)%></h3>
-            		<% for news in @news %>
+            		<%= render :partial => 'news/news', :collection => @news %>
-            			<p>
-            			<b><%= news.title %></b> (<%= link_to_user news.author %> <%= format_time(news.created_on) %> - <%= news.project.name %>)<br />
-            			<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
-            			[<%= link_to l(:label_read), :controller => 'news', :action => 'show', :id => news %>]
-            			</p>
-            			<hr />
-            		<% end %>
             	</div>
             </div>
             <div class="splitcontentright">
             	<div class="box">
             	<h3><%=l(:label_project_latest)%></h3>
             		<ul>
             		<% for project in @projects %>
             			<li>
             			<%= link_to project.name, :controller => 'projects', :action => 'show', :id => project %> (<%= format_time(project.created_on) %>)<br />
-            			<%= project.description %>
+            			<%=h project.description %>
             			</li>
             		<% end %>
             		</ul>
             	</div>
             </div>

public/stylesheets/application.css +3 0

             /* andreas08 - an open source xhtml/css website layout by Andreas Viklund - http://andreasviklund.com . Free to use in any way and for any purpose as long as the proper credits are given to the original designer. Version: 1.0, November 28, 2005 */
             /* Edited by Jean-Philippe Lang *>
             /**************** Body and tag styles ****************/
             #header * {margin:0; padding:0;}
             p, ul, ol, li {margin:0; padding:0;}
             body{
             font:76% Verdana,Tahoma,Arial,sans-serif;
             line-height:1.4em;
             text-align:center;
             color:#303030;
             background:#e8eaec;
             margin:0;
             }
             a{
             color:#467aa7;
             font-weight:bold;
             text-decoration:none;
             background-color:inherit;
             }
             a:hover{color:#2a5a8a; text-decoration:none; background-color:inherit;}
             a img{border:none;}
             p{padding:0 0 1em 0;}
             p form{margin-top:0; margin-bottom:20px;}
             img.left,img.center,img.right{padding:4px; border:1px solid #a0a0a0;}
             img.left{float:left; margin:0 12px 5px 0;}
             img.center{display:block; margin:0 auto 5px auto;}
             img.right{float:right; margin:0 0 5px 12px;}
             /**************** Header and navigation styles ****************/
             #container{
             width:100%;
             min-width: 800px;
             margin:0;
             padding:0;
             text-align:left;
             background:#ffffff;
             color:#303030;
             }
             #header{
             height:4.5em;
             /*width:758px;*/
             margin:0;
             background:#467aa7;
             color:#ffffff;
             margin-bottom:1px;
             }
             #header h1{
             padding:10px 0 0 20px;
             font-size:2em;
             background-color:inherit;
             color:#fff; /*rgb(152, 26, 33);*/
             letter-spacing:-1px;
             font-weight:bold;
             font-family: Trebuchet MS,Georgia,"Times New Roman",serif;
             }
             #header h2{
             margin:3px 0 0 40px;
             font-size:1.5em;
             background-color:inherit;
             color:#f0f2f4;
             letter-spacing:-1px;
             font-weight:normal;
             font-family: Trebuchet MS,Georgia,"Times New Roman",serif;
             }
             #navigation{
             height:2.2em;
             line-height:2.2em;
             /*width:758px;*/
             margin:0;
             background:#578bb8;
             color:#ffffff;
             }
             #navigation li{
             float:left;
             list-style-type:none;
             border-right:1px solid #ffffff;
             white-space:nowrap;
             }
             #navigation li.right {
              float:right;
             list-style-type:none;
             border-right:0;
             border-left:1px solid #ffffff;
             white-space:nowrap;
             }
             #navigation li a{
             display:block;
             padding:0px 10px 0px 22px;
             font-size:0.8em;
             font-weight:normal;
             /*text-transform:uppercase;*/
             text-decoration:none;
             background-color:inherit;
             color: #ffffff;
             }
             * html #navigation a {width:1%;}
             #navigation .selected,#navigation a:hover{
             color:#ffffff;
             text-decoration:none;
             background-color: #80b0da;
             }
             /**************** Icons links *******************/
             .picHome {	background: url(../images/home.png) no-repeat 4px 50%; }
             .picUser {	background: url(../images/user.png) no-repeat 4px 50%; }
             .picUserPage {	background: url(../images/user_page.png) no-repeat 4px 50%; }
             .picAdmin {	background: url(../images/admin.png) no-repeat 4px 50%; }
             .picProject { background: url(../images/projects.png) no-repeat 4px 50%; }
             .picLogout { background: url(../images/logout.png) no-repeat 4px 50%; }
             .picHelp { background: url(../images/help.png) no-repeat 4px 50%; }
             .picEdit { background: url(../images/edit.png) no-repeat 4px 50%; }
             .picDelete { background: url(../images/delete.png) no-repeat 4px 50%; }
             .picAdd { background: url(../images/add.png) no-repeat 4px 50%; }
             .picMove { background: url(../images/move.png) no-repeat 4px 50%; }
             .picCheck { background: url(../images/check.png) no-repeat 4px 70%; }
             .picPdf { background: url(../images/pdf.png) no-repeat 4px 50%;}
             .picCsv { background: url(../images/csv.png) no-repeat 4px 50%;}
             .pic { padding-left: 18px; margin-left: 3px; }
             /**************** Content styles ****************/
             html>body #content {
             height: auto;
             min-height: 500px;
             }
             #content{
             /*float:right;*/
             /*width:530px;*/
             width: auto;
             height:500px;
             font-size:0.9em;
             padding:20px 10px 10px 20px;
             /*position: absolute;*/
             margin-left: 120px;
             border-left: 1px dashed #c0c0c0;
             }
             #content h2{
             display:block;
             margin:0 0 16px 0;
             font-size:1.7em;
             font-weight:normal;
             letter-spacing:-1px;
             color:#606060;
             background-color:inherit;
             font-family: Trebuchet MS,Georgia,"Times New Roman",serif;
             }
             #content h2 a{font-weight:normal;}
             #content h3{margin:0 0 12px 0; font-size:1.4em;color:#707070;font-family: Trebuchet MS,Georgia,"Times New Roman",serif;}
             #content a:hover,#subcontent a:hover{text-decoration:underline;}
             #content ul,#content ol{margin:0 5px 16px 35px;}
             #content dl{margin:0 5px 10px 25px;}
             #content dt{font-weight:bold; margin-bottom:5px;}
             #content dd{margin:0 0 10px 15px;}
             /***********************************************/
             /*
             form{
             	padding:15px;
             	margin:0 0 20px 0;
             	border:1px solid #c0c0c0;
             	background-color:#CEE1ED;
             	width:600px;
             }
             */
             form {
             	display: inline;
             }
             .noborder {
             	border:0px;
             	background-color:#fff;
             	width:100%;
             }
             textarea {
                 padding:0;
                 margin:0;
             }
             blockquote {
                 padding-left: 6px;
                 border-left: 2px solid #ccc;
             }
             input {
             	vertical-align: middle;
             }
             input.button-small
             {
                 font-size: 0.8em;
             }
             select {
             	vertical-align: middle;
             }
             .select-small
             {
                border: 1px solid #7F9DB9;
                padding: 1px;
                font-size: 0.8em;
             }
             .active-filter
             {
               background-color: #F9FA9E;
             }
             label {
             	font-weight: bold;
             	font-size: 1em;
             }
             fieldset {
                 border:1px solid #7F9DB9;
                 padding: 6px;
             }
             legend {
                 color: #505050;
             }
             .required {
             	color: #bb0000;
             }
             table.listTableContent {
             	border:1px solid #578bb8;
             	width:100%;
             	border-collapse: collapse;
             }
             table.listTableContent td {
             	padding:2px;
             }
             tr.ListHead {
             	background-color:#467aa7;
             	color:#FFFFFF;
             	text-align:center;
             }
             tr.ListHead a {
             	color:#FFFFFF;
             	text-decoration:underline;
             }
             .odd {
             	background-color:#f0f1f2;
             }
             .even {
             	background-color: #fff;
             }
             table.reportTableContent {
             	border:1px solid #c0c0c0;
             	width:99%;
             	border-collapse: collapse;
             }
             table.reportTableContent td {
             	padding:2px;
             }
             table.calenderTable {
             	border:1px solid #578bb8;
             	width:99%;
             	border-collapse: collapse;
             }
             table.calenderTable td {
             	border:1px solid #578bb8;
             }
             hr { border:none; border-bottom: dotted 1px #c0c0c0; }
             /**************** Sidebar styles ****************/
             #subcontent{
             position: absolute;
             left: 0px;
             width:110px;
             padding:20px 20px 10px 5px;
             }
             #subcontent h2{
             display:block;
             margin:0 0 5px 0;
             font-size:1.0em;
             font-weight:bold;
             text-align:left;
             color:#606060;
             background-color:inherit;
             font-family: Trebuchet MS,Georgia,"Times New Roman",serif;
             }
             #subcontent p{margin:0 0 16px 0; font-size:0.9em;}
             /**************** Menublock styles ****************/
             .menublock{margin:0 0 20px 8px; font-size:0.8em;}
             .menublock li{list-style:none; display:block; padding:1px; margin-bottom:0px;}
             .menublock li a{font-weight:bold; text-decoration:none;}
             .menublock li a:hover{text-decoration:none;}
             .menublock li ul{margin:0; font-size:1em; font-weight:normal;}
             .menublock li ul li{margin-bottom:0;}
             .menublock li ul a{font-weight:normal;}
             /**************** Searchbar styles ****************/
             #searchbar{margin:0 0 20px 0;}
             #searchbar form fieldset{margin-left:10px; border:0 solid;}
             #searchbar #s{
             height:1.2em;
             width:110px;
             margin:0 5px 0 0;
             border:1px solid #a0a0a0;
             }
             #searchbar #searchbutton{
             width:auto;
             padding:0 1px;
             border:1px solid #808080;
             font-size:0.9em;
             text-align:center;
             }
             /**************** Footer styles ****************/
             #footer{
             clear:both;
             /*width:758px;*/
             padding:5px 0;
             margin:0;
             font-size:0.9em;
             color:#f0f0f0;
             background:#467aa7;
             }
             #footer p{padding:0; margin:0; text-align:center;}
             #footer a{color:#f0f0f0; background-color:inherit; font-weight:bold;}
             #footer a:hover{color:#ffffff; background-color:inherit; text-decoration: underline;}
             /**************** Misc classes and styles ****************/
             .splitcontentleft{float:left; width:49%;}
             .splitcontentright{float:right; width:49%;}
             .clear{clear:both;}
             .small{font-size:0.8em;line-height:1.4em;padding:0 0 0 0;}
             .hide{display:none;}
             .textcenter{text-align:center;}
             .textright{text-align:right;}
             .important{color:#f02025; background-color:inherit; font-weight:bold;}
             .box{
             margin:0 0 20px 0;
             padding:10px;
             border:1px solid #c0c0c0;
             background-color:#fafbfc;
             color:#505050;
             line-height:1.5em;
             }
             a.close-icon {
             display:block;
             margin-top:3px;
             overflow:hidden;
             width:12px;
             height:12px;
             background-repeat: no-repeat;
             cursor:hand;
             cursor:pointer;
             background-image:url('../images/close.png');
             }
             a.close-icon:hover {
             background-image:url('../images/close_hl.png');
             }
             .rightbox{
             background: #fafbfc;
             border: 1px solid #c0c0c0;
             float: right;
             padding: 8px;
             position: relative;
             margin: 0 5px 5px;
             }
             .layout-active {
             background: #ECF3E1;
             }
             .block-receiver {
             border:1px dashed #c0c0c0;
             margin-bottom: 20px;
             padding: 15px 0 15px 0;
             }
             .mypage-box {
             margin:0 0 20px 0;
             color:#505050;
             line-height:1.5em;
             }
             .handle {
             cursor: move;
             }
             .topright{
             position: absolute;
             right: 25px;
             top: 100px;
             }
             .login {
             width: 50%;
             text-align: left;
             }
             img.calendar-trigger {
                 cursor: pointer;
                 vertical-align: middle;
                 margin-left: 4px;
             }
             #history h4, #comments h4 {
                 font-size: 1em;
                 margin-bottom: 12px;
                 margin-top: 20px;
                 font-weight: normal;
                 border-bottom: dotted 1px #c0c0c0;
             }
             #history p {
                 margin-left: 34px;
             }
             /***** Contextual links div *****/
             .contextual {
             float: right;
             font-size: 0.8em;
             }
+            .contextual select {
+            font-size: 1em;
+            }
             /***** CSS FORM ******/
             .tabular p{
             margin: 0;
             padding: 5px 0 8px 0;
             padding-left: 180px; /*width of left column containing the label elements*/
             height: 1%;
             }
             .tabular label{
             font-weight: bold;
             float: left;
             margin-left: -180px; /*width of left column*/
             width: 175px; /*width of labels. Should be smaller than left column to create some right
             margin*/
             }
             .error {
             color: #cc0000;
             }
             /*.threepxfix class below:
             Targets IE6- ONLY. Adds 3 pixel indent for multi-line form contents.
             to account for 3 pixel bug: http://www.positioniseverything.net/explorer/threepxtest.html
             */
             * html .threepxfix{
             margin-left: 3px;
             }

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages