Merge pull request #1755 from akshitahluwalia/hakiri-fix

fixed hakiri xss warnings.

app/views/conferences/_venue.html.haml

@@ -32,4 +32,4 @@
           = @conference.venue.country_name
           - if @conference.venue.website
             %br
-            =link_to @conference.venue.website, @conference.venue.website
+            =link_to(h(@conference.venue.website), h(@conference.venue.website)).html_safe

app/views/conferences/_venue_map.html.haml

@@ -3,15 +3,15 @@
 - content_for(:script_body) do
   :javascript
     // create a map in the "map" div, set the view to a given place and zoom
-    var map = L.map('map', { scrollWheelZoom: false }).setView([#{@conference.venue.latitude}, #{@conference.venue.longitude}], 11);
+    var map = L.map('map', { scrollWheelZoom: false }).setView([#{h(@conference.venue.latitude)}, #{h(@conference.venue.longitude)}], 11);
     // add an OpenStreetMap tile layer
     L.tileLayer('//{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
       attribution: 'Map data &copy; <a href="http://openstreetmap.org">OpenStreetMap</a> contributors, <a href="http://creativecommons.org/licenses/by-sa/2.0/">CC-BY-SA</a>, Imagery © <a href="http://mapbox.com">Mapbox</a>',
       maxZoom: 18
     }).addTo(map);
     // add a marker in the given location, attach some popup content to it and open the popup
-    L.marker([#{@conference.venue.latitude}, #{@conference.venue.longitude}]).addTo(map)
-      .bindPopup("#{popup}")
+    L.marker([#{h(@conference.venue.latitude)}, #{h(@conference.venue.longitude)}]).addTo(map)
+      .bindPopup("#{h(popup)}")
       .openPopup();
     // Turn scrollwheel on when user clicks
     map.on('focus', function(e) {

app/views/conferences/show.html.haml

@@ -82,7 +82,7 @@
 
 - content_for :script_head do
   :javascript
-    var triangle_tcs = tinycolor("#{@conference.color}").monochromatic();
+    var triangle_tcs = tinycolor("#{h(@conference.color)}").monochromatic();
     var triangle_colors = triangle_tcs.map(function(t) { return t.toHexString(); });
     $(function () {
       $(document).ready(function() {