Fixed realtime and history dashboards.

lib/sidekiq/web.rb

@@ -1,3 +1,4 @@
+require 'erb'
 require 'yaml'
 require 'sinatra/base'
 
@@ -157,6 +158,10 @@ module Sidekiq
       def redis_keys
         ["redis_stats", "uptime_in_days", "connected_clients", "used_memory_human", "used_memory_peak_human"]
       end
+
+      def h(text)
+        ERB::Util.h(text)
+      end
     end
 
     get "/workers" do

web/views/dashboard.erb

@@ -1,4 +1,4 @@
-<script type="text/javascript" src="#<%= root_path %>javascripts/dashboard.js"></script>
+<script type="text/javascript" src="<%= root_path %>javascripts/dashboard.js"></script>
 
 <h3>
   <%= t('Dashboard') %>
@@ -18,7 +18,7 @@
   <a href="<%= root_path %>?days=90" class="history-graph <%= "active" if params[:days] == "90" %>"><%= t('ThreeMonths') %></a>
   <a href="<%= root_path %>?days=180" class="history-graph <%= "active" if params[:days] == "180" %>"><%= t('SixMonths') %></a>
 </h5>
-<div id="history" data-processed="<%= Sidekiq.dump_json(@processed_history) %>" data-failed="<%= Sidekiq.dump_json(@failed_history) %>" data-update-url="<%= root_path %>dashboard/stats"></div>
+<div id="history" data-processed="<%= h Sidekiq.dump_json(@processed_history) %>" data-failed="<%= h Sidekiq.dump_json(@failed_history) %>" data-update-url="<%= root_path %>dashboard/stats"></div>
 
 <br/>
 <h5>Redis</h5>

web/views/queue.erb

@@ -28,7 +28,7 @@
       </td>
       <td>
         <form action="<%= root_path %>queues/<%= @name %>/delete" method="post">
-          <input name="key_val" value="<%= Sidekiq.dump_json(msg) %>" type="hidden" />
+          <input name="key_val" value="<%= h Sidekiq.dump_json(msg) %>" type="hidden" />
           <input class="btn btn-danger btn-mini" type="submit" name="delete" value="<%= t('Delete') %>" data-confirm="<%= t('AreYouSure') %>" />
         </form>
       </td>