a5e08f7bcc
I installed the rails_xss plugin, for the main purpose of seeing what will break with Rails 3.0 (where the behaviour of the plugin is the default). I think I've fixed everything, but let me know if you see stuff that is HTML-escaped, which shouldn't be. As a side benefit, we now use Erubis, rather than ERB, to render templates. They tell me it's faster ...
32 lines
No EOL
1.4 KiB
Text
32 lines
No EOL
1.4 KiB
Text
<%- @title = "Uploaded Files" -%>
|
|
|
|
<% form_tag({ :controller => 'admin', :action => 'delete_files', :web => @web.address },
|
|
{'method' => 'post', 'accept-charset' => 'utf-8' }) do
|
|
%>
|
|
<div id="allFiles">
|
|
<h2>
|
|
Uploaded Files in <%= @web.name %>
|
|
</h2>
|
|
|
|
<%- if @file_list.empty? -%>
|
|
<p>No uploaded files in this Web</p>
|
|
<%- else -%>
|
|
<p>Check the files you wish to delete (<%= link_to "sort by #{@alt_sort_name}", :controller => 'wiki',
|
|
:web => @web.address, :action => 'file_list', :sort_order => @alt_sort_order %>).</p>
|
|
<ul style="list-style-type:none">
|
|
<%- for file in @file_list -%>
|
|
<li>
|
|
<input type="checkbox" name="<%= file.file_name %>" value="delete"/>
|
|
<a href="<%= url_for :web => @web.address, :action => 'files',
|
|
:id => file.file_name %>"><%= file.file_name%></a> (<%= file.created_at.asctime %>) <span class="linked"><%= "Linked to by: " unless
|
|
@web.pages_that_link_to_file(file.file_name).empty? -%>
|
|
<%= @web.pages_that_link_to_file(file.file_name).collect { |referring_page| link_to_page(referring_page) }.join(", ").html_safe %></span>
|
|
</li>
|
|
<%- end -%>
|
|
</ul>
|
|
<label for="system_password">Enter system password</label>
|
|
<%= password_field_tag "system_password", '', :class => "disableAutoComplete" %>
|
|
and <%= submit_tag("Delete Files") %>
|
|
<%- end -%>
|
|
</div>
|
|
<%- end -%> |