diff options
| author | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2007-03-21 06:05:21 +0000 |
|---|---|---|
| committer | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2007-03-21 06:05:21 +0000 |
| commit | 1c65ca492295e754dfd9986f91b08eb0876d09b9 (patch) | |
| tree | f5ef8f767cf58055381e730e88a56f30ffa586b6 /templates/page.tmpl | |
| parent | 9bf29d60b2b44c16e9c3aaf1f4ff78a694f3c194 (diff) | |
| download | ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar.gz | |
* Fix a few bugs around page titles containing html. The worst of these
is an actual security hole as it allows insertion of html into the title
element of a page, which is not processed by the htmlscrubber.
Diffstat (limited to 'templates/page.tmpl')
| -rw-r--r-- | templates/page.tmpl | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/templates/page.tmpl b/templates/page.tmpl index 471ed1a7d..2c28a68f5 100644 --- a/templates/page.tmpl +++ b/templates/page.tmpl @@ -3,7 +3,7 @@ <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> -<title><TMPL_VAR TITLE></title> +<title><TMPL_VAR TITLE ESCAPE=HTML></title> <link rel="stylesheet" href="<TMPL_VAR BASEURL>style.css" type="text/css" /> <link rel="stylesheet" href="<TMPL_VAR BASEURL>local.css" type="text/css" /> <TMPL_IF NAME="FAVICON"> @@ -19,7 +19,7 @@ <TMPL_LOOP NAME="PARENTLINKS"> <a href="<TMPL_VAR NAME=URL>"><TMPL_VAR NAME=PAGE></a>/ </TMPL_LOOP> -<TMPL_VAR TITLE> +<TMPL_VAR TITLE ESCAPE=HTML> </span> <TMPL_IF NAME="SEARCHFORM"> <TMPL_VAR SEARCHFORM> |