Redmine/app/views/my/blocks/_latest_news.rhtml
Jean-Philippe Lang 2b86ef8e28 various modifications to prevent xss
- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81
2006-12-17 08:10:18 +00:00

7 lines
399 B
Plaintext

<h3><%=l(:label_news_latest)%></h3>
<%= render (:partial => 'news/news',
:collection => News.find(:all,
:limit => 10,
:conditions => "news.project_id in (#{@user.projects.collect{|m| m.id}.join(',')})",
:include => [:project, :author])) unless @user.projects.empty? %>