diff options
| author | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2007-03-21 06:05:21 +0000 |
|---|---|---|
| committer | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2007-03-21 06:05:21 +0000 |
| commit | 1c65ca492295e754dfd9986f91b08eb0876d09b9 (patch) | |
| tree | f5ef8f767cf58055381e730e88a56f30ffa586b6 /templates/titlepage.tmpl | |
| parent | 9bf29d60b2b44c16e9c3aaf1f4ff78a694f3c194 (diff) | |
| download | ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar ikiwiki-1c65ca492295e754dfd9986f91b08eb0876d09b9.tar.gz | |
* Fix a few bugs around page titles containing html. The worst of these
is an actual security hole as it allows insertion of html into the title
element of a page, which is not processed by the htmlscrubber.
Diffstat (limited to 'templates/titlepage.tmpl')
| -rw-r--r-- | templates/titlepage.tmpl | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/templates/titlepage.tmpl b/templates/titlepage.tmpl index f5cd5bc53..0676a098e 100644 --- a/templates/titlepage.tmpl +++ b/templates/titlepage.tmpl @@ -1 +1 @@ -<p><a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a></p> +<p><a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a></p> |