xss vulnerability in empty search results page

2011-05-13 08:20:09 -04:00 · 2011-05-13 08:20:09 -04:00 · 1b3669178c
commit 1b3669178c
parent c23024b43a
1 changed files with 1 additions and 1 deletions
--- a/app/views/items/index.html.haml
+++ b/app/views/items/index.html.haml
@ -2,7 +2,7 @@
  - title "Searching Infinite Closet for \"#{@query}\""
  - if @items.empty?
    :markdown
-      We couldn't find any wearables that matched **#{@query}**. Sorry!
+      We couldn't find any wearables that matched **#{h @query}**. Sorry!

      Are we missing something? To add an item to our database, just
      [show us a pet who is wearing it][1]. That's it!