Cool_Tools/vichan
1
0
Fork 0
mirror of https://github.com/vichan-devel/vichan.git synced 2024-11-27 17:00:52 +01:00
Code Releases Wiki Activity

Fixed XSS in post edit page and modsearch

Browse Source
This commit is contained in:
antedeguemon 2017-05-21 17:08:43 -03:00
parent e672d490cd
commit 4f85b7c570
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
templates/mod/edit_post_form.html
View File

@ -7,7 +7,7 @@
{% trans %}Name{% endtrans %}
</th>
<td>
<input type="text" name="name" size="25" maxlength="35" autocomplete="off" value="{{ post.name }}">
<input type="text" name="name" size="25" maxlength="35" autocomplete="off" value="{{ post.name|e }}">
</td>
</tr>
<tr>
@ -23,7 +23,7 @@
{% trans %}Subject{% endtrans %}
</th>
<td>
<input style="float:left;" type="text" name="subject" size="25" maxlength="100" autocomplete="off" value="{{ post.subject }}">
<input style="float:left;" type="text" name="subject" size="25" maxlength="100" autocomplete="off" value="{{ post.subject|e }}">
<input accesskey="s" style="margin-left:2px;" type="submit" name="post" value="{% trans %}Update{% endtrans %}">
</td>
</tr>

4
templates/mod/search_results.html
View File

@ -224,7 +224,7 @@
<a class="email" href="mailto:{{ post.email }}">
{% endif %}
{% set capcode = post.capcode|capcode %}
<span {% if capcode.name %}style="{{ capcode.name }}" {% endif %}class="name">{{ post.name }}</span>
<span {% if capcode.name %}style="{{ capcode.name }}" {% endif %}class="name">{{ post.name|e }}</span>
{% if post.trip|length > 0 %}
<span {% if capcode.trip %}style="{{ capcode.trip }}" {% endif %}class="trip">{{ post.trip }}</span>
{% endif %}
@ -239,7 +239,7 @@
</td>
<td style="max-width:250px">
{% if post.subject %}
<small>{{ post.subject }}</small>
<small>{{ post.subject|e }}</small>
{% else %}
&ndash;
{% endif %}