管理员界面的留言列表优化

app/views/admin/leave_messages.html.erb

@@ -59,12 +59,12 @@
           <td class="center">
             <%= format_date(journal.created_on) %>
           </td>
-          <td style="white-space: nowrap;overflow: hidden;text-overflow: ellipsis;" title='<%=journal.notes %>'>
+          <td style="white-space: nowrap;overflow: hidden;text-overflow: ellipsis;" title='<%=strip_html(journal.notes) %>'>
             <%case journal.jour_type %>
             <% when 'Principal' %>
-                <%= link_to(journal.notes.html_safe, feedback_path(journal.jour_id)) %>
+                <%= link_to(strip_html(journal.notes), feedback_path(journal.jour_id)) %>
             <% when 'Course' %>
-                <%= link_to(journal.notes.html_safe, course_feedback_path(journal.jour_id)) %>
+                <%= link_to(strip_html(journal.notes), course_feedback_path(journal.jour_id)) %>
             <% end %>
           </td>
           <td class="center">

app/views/users/_user_jours_list.html.erb

@@ -5,7 +5,7 @@
 
 <%if jours %>
     <% jours.each do |jour|%>
-        <% unless jour.private == 1 && (!User.current || (User.current && jour.jour_id != User.current.id && jour.user_id != User.current.id)) %>
+        <% unless jour.private == 1 && (!User.current || (User.current && jour.jour_id != User.current.id && jour.user_id != User.current.id && !User.current.admin?)) %>
             <script type="text/javascript">
                 $(function(){
                     sd_create_editor_from_data(<%= jour.id%>, null, "100%", "<%=jour.class.to_s%>");