diff options
| author | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2007-03-21 06:05:21 +0000 |
|---|---|---|
| committer | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2007-03-21 06:05:21 +0000 |
| commit | 1c65ca492295e754dfd9986f91b08eb0876d09b9 (patch) | |
| tree | f5ef8f767cf58055381e730e88a56f30ffa586b6 /templates/inlinepage.tmpl | |
| parent | 9bf29d60b2b44c16e9c3aaf1f4ff78a694f3c194 (diff) | |
| download | ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar.gz | |
* Fix a few bugs around page titles containing html. The worst of these
is an actual security hole as it allows insertion of html into the title
element of a page, which is not processed by the htmlscrubber.
Diffstat (limited to 'templates/inlinepage.tmpl')
| -rw-r--r-- | templates/inlinepage.tmpl | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/templates/inlinepage.tmpl b/templates/inlinepage.tmpl index 0317c248c..f1f21d4be 100644 --- a/templates/inlinepage.tmpl +++ b/templates/inlinepage.tmpl @@ -10,9 +10,9 @@ </TMPL_IF> <span class="header"> <TMPL_IF NAME="PERMALINK"> -<a href="<TMPL_VAR PERMALINK>"><TMPL_VAR TITLE></a> +<a href="<TMPL_VAR PERMALINK>"><TMPL_VAR TITLE ESCAPE=HTML></a> <TMPL_ELSE> -<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a> +<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a> </TMPL_IF> </span> <TMPL_VAR CONTENT> |