aboutsummaryrefslogtreecommitdiff
path: root/templates/page.tmpl
diff options
context:
space:
mode:
authorjoey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>2007-03-21 06:05:21 +0000
committerjoey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>2007-03-21 06:05:21 +0000
commit1c65ca492295e754dfd9986f91b08eb0876d09b9 (patch)
treef5ef8f767cf58055381e730e88a56f30ffa586b6 /templates/page.tmpl
parent9bf29d60b2b44c16e9c3aaf1f4ff78a694f3c194 (diff)
downloadikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar
ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar.gz
* Fix a few bugs around page titles containing html. The worst of these
is an actual security hole as it allows insertion of html into the title element of a page, which is not processed by the htmlscrubber.
Diffstat (limited to 'templates/page.tmpl')
-rw-r--r--templates/page.tmpl4
1 files changed, 2 insertions, 2 deletions
diff --git a/templates/page.tmpl b/templates/page.tmpl
index 471ed1a7d..2c28a68f5 100644
--- a/templates/page.tmpl
+++ b/templates/page.tmpl
@@ -3,7 +3,7 @@
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<title><TMPL_VAR TITLE></title>
+<title><TMPL_VAR TITLE ESCAPE=HTML></title>
<link rel="stylesheet" href="<TMPL_VAR BASEURL>style.css" type="text/css" />
<link rel="stylesheet" href="<TMPL_VAR BASEURL>local.css" type="text/css" />
<TMPL_IF NAME="FAVICON">
@@ -19,7 +19,7 @@
<TMPL_LOOP NAME="PARENTLINKS">
<a href="<TMPL_VAR NAME=URL>"><TMPL_VAR NAME=PAGE></a>/
</TMPL_LOOP>
-<TMPL_VAR TITLE>
+<TMPL_VAR TITLE ESCAPE=HTML>
</span>
<TMPL_IF NAME="SEARCHFORM">
<TMPL_VAR SEARCHFORM>