diff options
| author | rr- | 2016-06-23 11:41:52 +0200 |
|---|---|---|
| committer | rr- | 2016-06-23 12:47:56 +0200 |
| commit | 6ea129a9ef629d89b03d925925c0704d8eec586f (patch) | |
| tree | c3c91c9a9f7c70c02176f529352909be02bea344 /client/html/posts_page.tpl | |
| parent | b957f3ae36da402ad4d9ac23563aa3975f9659f3 (diff) | |
client/views: escape HTML
This lets client use < > in tag names.
Diffstat (limited to 'client/html/posts_page.tpl')
| -rw-r--r-- | client/html/posts_page.tpl | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/client/html/posts_page.tpl b/client/html/posts_page.tpl index 96e1b52..6eb6cd2 100644 --- a/client/html/posts_page.tpl +++ b/client/html/posts_page.tpl @@ -5,35 +5,35 @@ <li> <% if (ctx.canViewPosts) { %> <% if (ctx.searchQuery && ctx.searchQuery.text) { %> - <a href='/post/<%= post.id %>/text=<%= ctx.searchQuery.text %>' title='@<%= post.id %> (<%= post.type %>) Tags: <%= post.tags.map(tag => '#' + tag).join(' ') %>'> + <a href='/post/<%- post.id %>/text=<%- ctx.searchQuery.text %>' title='@<%- post.id %> (<%- post.type %>) Tags: <%- post.tags.map(tag => '#' + tag).join(' ') %>'> <% } else { %> - <a href='/post/<%= post.id %>' title='@<%= post.id %> (<%= post.type %>) Tags: <%= post.tags.map(tag => '#' + tag).join(' ') %>'> + <a href='/post/<%- post.id %>' title='@<%- post.id %> (<%- post.type %>) Tags: <%- post.tags.map(tag => '#' + tag).join(' ') %>'> <% } %> <% } else { %> <a> <% } %> <%= ctx.makeThumbnail(post.thumbnailUrl) %> - <span class='type' data-type='<%= post.type %>'> - <%= post.type %> + <span class='type' data-type='<%- post.type %>'> + <%- post.type %> </span> <% if (post.score || post.favoriteCount || post.commentCount) { %> <span class='stats'> <% if (post.score) { %> <span class='icon'> <i class='fa fa-star'></i> - <%= post.score %> + <%- post.score %> </span> <% } %> <% if (post.favoriteCount) { %> <span class='icon'> <i class='fa fa-heart'></i> - <%= post.favoriteCount %> + <%- post.favoriteCount %> </span> <% } %> <% if (post.commentCount) { %> <span class='icon'> <i class='fa fa-commenting'></i> - <%= post.commentCount %> + <%- post.commentCount %> </span> <% } %> </span> |