diff options
| author | rr- | 2016-06-23 12:19:32 +0200 |
|---|---|---|
| committer | rr- | 2016-06-23 12:47:56 +0200 |
| commit | c7f6663c367cca8be3343a695d3f5ed052d781a0 (patch) | |
| tree | ab282c60fbb4dc1de50a398f233bfeefc7a2fd9a /client/html/posts_page.tpl | |
| parent | 6ea129a9ef629d89b03d925925c0704d8eec586f (diff) | |
client/general: escape entity names in links
Diffstat (limited to 'client/html/posts_page.tpl')
| -rw-r--r-- | client/html/posts_page.tpl | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/client/html/posts_page.tpl b/client/html/posts_page.tpl index 6eb6cd2..5e2b3e8 100644 --- a/client/html/posts_page.tpl +++ b/client/html/posts_page.tpl @@ -5,9 +5,9 @@ <li> <% if (ctx.canViewPosts) { %> <% if (ctx.searchQuery && ctx.searchQuery.text) { %> - <a href='/post/<%- post.id %>/text=<%- ctx.searchQuery.text %>' title='@<%- post.id %> (<%- post.type %>) Tags: <%- post.tags.map(tag => '#' + tag).join(' ') %>'> + <a href='/post/<%- encodeURIComponent(post.id) %>/text=<%- encodeURIComponent(ctx.searchQuery.text) %>' title='@<%- post.id %> (<%- post.type %>) Tags: <%- post.tags.map(tag => '#' + tag).join(' ') %>'> <% } else { %> - <a href='/post/<%- post.id %>' title='@<%- post.id %> (<%- post.type %>) Tags: <%- post.tags.map(tag => '#' + tag).join(' ') %>'> + <a href='/post/<%- encodeURIComponent(post.id) %>' title='@<%- post.id %> (<%- post.type %>) Tags: <%- post.tags.map(tag => '#' + tag).join(' ') %>'> <% } %> <% } else { %> <a> |