Merge pull request #23 from finnlabs/feature/rails3_escape_units

CHANGELOG.md

@@ -1,5 +1,7 @@
 # Changelog
 
+* `#1020` fix XSS when displaying costs
+
 ## 0.0.1.pre6
 
 * fix minor css alignment issue

lib/widget/table/report_table.rb

@@ -116,7 +116,7 @@ class Widget::Table::ReportTable < Widget::Table
         opts = { :colspan => column.final_number(:column) }
         opts.merge!(:class => "inner") if first
         write(content_tag(:th, opts) do
-          "#{show_result(column)}" #{debug_fields(column)}
+          show_result(column) #{debug_fields(column)}
         end)
       end
       if last_in_col