response.rb in radiant-0.7.0

- old
+ new

@@ -28,12 +28,12 @@
       charset.blank? ? nil : charset.strip.split("=")[1]
     end
 
     def redirect(to_url, response_status)
       self.headers["Status"] = response_status
-      self.headers["Location"] = to_url
+      self.headers["Location"] = to_url.gsub(/[\r\n]/, '')
 
-      self.body = "<html><body>You are being <a href=\"#{to_url}\">redirected</a>.</body></html>"
+      self.body = "<html><body>You are being <a href=\"#{CGI.escapeHTML(to_url)}\">redirected</a>.</body></html>"
     end
 
     def prepare!
       handle_conditional_get!
       convert_content_type!
\ No newline at end of file