diff options
| author | rr- | 2016-06-23 12:19:32 +0200 |
|---|---|---|
| committer | rr- | 2016-06-23 12:47:56 +0200 |
| commit | c7f6663c367cca8be3343a695d3f5ed052d781a0 (patch) | |
| tree | ab282c60fbb4dc1de50a398f233bfeefc7a2fd9a /client/html/comment.tpl | |
| parent | 6ea129a9ef629d89b03d925925c0704d8eec586f (diff) | |
client/general: escape entity names in links
Diffstat (limited to 'client/html/comment.tpl')
| -rw-r--r-- | client/html/comment.tpl | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/client/html/comment.tpl b/client/html/comment.tpl index 520d372..da91a03 100644 --- a/client/html/comment.tpl +++ b/client/html/comment.tpl @@ -1,7 +1,7 @@ <div class='comment'> <div class='avatar'> <% if (ctx.comment.user.name && ctx.canViewUsers) { %> - <a href='/user/<%- ctx.comment.user.name %>'> + <a href='/user/<%- encodeURIComponent(ctx.comment.user.name) %>'> <% } %> <%= ctx.makeThumbnail(ctx.comment.user.avatarUrl) %> @@ -15,7 +15,7 @@ <header><!-- --><span class='nickname'><!-- --><% if (ctx.comment.user.name && ctx.canViewUsers) { %><!-- - --><a href='/user/<%- ctx.comment.user.name %>'><!-- + --><a href='/user/<%- encodeURIComponent(ctx.comment.user.name) %>'><!-- --><% } %><!-- --><%- ctx.comment.user.name %><!-- |