Fix vulnerable.

app/views/admin/application_forms/_application_form_signup_render_table.html.erb

@@ -81,7 +81,7 @@
                         <% val = t("application_form.registration_status_#{application_form_signup.status}") if !application_form_signup.status.blank? %>
                     <% end %>                    
                 <% elsif names[0] == "application_form_signup_field_custom" || names[0] == "application_form_signup_fields" %>
-                  <% val = application_form_signup.application_form_signup_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale) rescue "" %>
+                  <% val = html_escape(application_form_signup.application_form_signup_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "" %>
                 <% elsif names[0] == "application_form_signup_contributes" %>
                   <% if names[1] == "file" %>
                     <% val = application_form_signup_contributes %>
@@ -103,16 +103,17 @@
                     <% end %>
                   <% end %>
                 <% elsif names[0] == "application_form_submission_fields" %>
-                  <% val = application_form_signup_contributes.collect{|s| (s.application_form_submission_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale) rescue "")} %>
                   <% application_form_submission_field = application_form_signup.application_form_main.application_form_submission_fields.where(:key=>names[1]).first %>
-                  <% if application_form_submission_field && application_form_submission_field.markup == "application_form_preferred_session"
-                      val = application_form_signup_contributes.collect{|s| 
-                        application_form_submission_value = s.application_form_submission_values.where(:key=>names[1]).first
-                        "<span data-id=\"#{application_form_submission_value.id rescue ''}\">#{(application_form_submission_value.get_value_by_locale(I18n.locale) rescue "")}</span>"}
-                      edit_urls[i] = []
-                      application_form_submission_values = application_form_signup_contributes.collect{|s| s.application_form_submission_values.where(:key=>names[1]).first }
-                      edit_urls[i] = application_form_submission_values.map{|application_form_submission_value| edit_admin_application_form_submission_value_path(application_form_submission_value.id) rescue "#"}
-                     end %>
+                  <%  if application_form_submission_field && application_form_submission_field.markup == "application_form_preferred_session"
+                        val = application_form_signup_contributes.collect{|s| 
+                          application_form_submission_value = s.application_form_submission_values.where(:key=>names[1]).first
+                          "<span data-id=\"#{application_form_submission_value.id rescue ''}\">#{(html_escape(application_form_submission_value.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "")}</span>"}
+                        edit_urls[i] = []
+                        application_form_submission_values = application_form_signup_contributes.collect{|s| s.application_form_submission_values.where(:key=>names[1]).first }
+                        edit_urls[i] = application_form_submission_values.map{|application_form_submission_value| edit_admin_application_form_submission_value_path(application_form_submission_value.id) rescue nil}
+                      else
+                        val = application_form_signup_contributes.collect{|s| (html_escape(s.application_form_submission_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "")}
+                      end %>
                 <% elsif  names[0] == "application_form_signup" %>
                   <% val = (application_form_signup.send("display_"+names[1]) rescue application_form_signup.send(names[1])) rescue nil %>
                   <% val = val.strftime('%Y/%m/%d %H:%M') if names[1] == 'created_at' %>

app/views/admin/application_forms/_application_form_signup_session_dashboard.html.erb

@@ -27,7 +27,7 @@
           content_tag :div, paginate(@application_form_signups), class: "pagination pagination-centered"
         end
       %>
-      <%= pagination_html.gsub(/page_no#{count}=\d*/,"").gsub('&&','&').gsub(/page=(\d*)/m){|ff| ff.gsub("page=#{$1}","page=#{params[:page]}&page_no#{count}=#{$1}")}.html_safe %>
+      <%= pagination_html.gsub(/page_no#{count}=\d*/,"").gsub('&&','&').gsub(/page=(\d*)/m){|ff| ff.gsub("page=#{$1}","page=#{(params[:page] ? params[:page].to_s.to_i : nil)}&page_no#{count}=#{$1}")}.html_safe %>
     </div>
   <% end %>
   <% if count != 2 && @application_form.summary_chioices.count >= 2 %>

app/views/admin/application_forms/_get_display_fields.html.erb

@@ -69,9 +69,12 @@
     <% application_form_signup_field_sets = ApplicationFormSignupFieldSet.all.uniq{|s| s.field_name} %>
     <% if application_form_signup_field_sets.count != 0 %>
        <% application_form_signup_field_sets.each do |field_set| %>
-            <% next if ApplicationFormMain::ExceptFieldSetDisplays.include?(field_set) %>
-            <% default_show << "application_form_signup_field_set.#{field_set.field_name}" if !(field_set.hidden) %>
-            <% @field_names << "application_form_signup_field_set.#{field_set.field_name}" %>
+            <%
+                field_name = field_set.field_name
+                next if ApplicationFormMain::ExceptFieldSetDisplays.include?(field_name)
+            %>
+            <% default_show << "application_form_signup_field_set.#{field_name}" if !(field_set.hidden) %>
+            <% @field_names << "application_form_signup_field_set.#{field_name}" %>
             <% @field_name_translations << field_set.name[I18n.locale] %>
        <% end %>
     <% else %>