From 02e2831980ee7b2d9db591adb61af7bad346f83f Mon Sep 17 00:00:00 2001
From: cxt <pinecxt@163.com>
Date: Sun, 12 Jun 2016 17:17:37 +0800
Subject: [PATCH] =?UTF-8?q?=E7=AE=A1=E7=90=86=E5=91=98=E7=95=8C=E9=9D=A2?=
 =?UTF-8?q?=E7=9A=84=E7=95=99=E8=A8=80=E5=88=97=E8=A1=A8=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/views/admin/leave_messages.html.erb   | 6 +++---
 app/views/users/_user_jours_list.html.erb | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/admin/leave_messages.html.erb b/app/views/admin/leave_messages.html.erb
index dee8b7443..986823faa 100644
--- a/app/views/admin/leave_messages.html.erb
+++ b/app/views/admin/leave_messages.html.erb
@@ -59,12 +59,12 @@
           <td class="center">
             <%= format_date(journal.created_on) %>
           </td>
-          <td style="white-space: nowrap;overflow: hidden;text-overflow: ellipsis;" title='<%=journal.notes %>'>
+          <td style="white-space: nowrap;overflow: hidden;text-overflow: ellipsis;" title='<%=strip_html(journal.notes) %>'>
             <%case journal.jour_type %>
             <% when 'Principal' %>
-                <%= link_to(journal.notes.html_safe, feedback_path(journal.jour_id)) %>
+                <%= link_to(strip_html(journal.notes), feedback_path(journal.jour_id)) %>
             <% when 'Course' %>
-                <%= link_to(journal.notes.html_safe, course_feedback_path(journal.jour_id)) %>
+                <%= link_to(strip_html(journal.notes), course_feedback_path(journal.jour_id)) %>
             <% end %>
           </td>
           <td class="center">
diff --git a/app/views/users/_user_jours_list.html.erb b/app/views/users/_user_jours_list.html.erb
index afd498d06..6211aac7d 100644
--- a/app/views/users/_user_jours_list.html.erb
+++ b/app/views/users/_user_jours_list.html.erb
@@ -5,7 +5,7 @@
 
 <%if jours %>
     <% jours.each do |jour|%>
-        <% unless jour.private == 1 && (!User.current || (User.current && jour.jour_id != User.current.id && jour.user_id != User.current.id)) %>
+        <% unless jour.private == 1 && (!User.current || (User.current && jour.jour_id != User.current.id && jour.user_id != User.current.id && !User.current.admin?)) %>
             <script type="text/javascript">
                 $(function(){
                     sd_create_editor_from_data(<%= jour.id%>, null, "100%", "<%=jour.class.to_s%>");