diff options
| author | Marcin Łabanowski <marcin@6irc.net> | 2014-07-05 23:01:37 +0200 |
|---|---|---|
| committer | Marcin Łabanowski <marcin@6irc.net> | 2014-07-05 23:01:37 +0200 |
| commit | fcf3863d47b02be46d35a13377c56a628d465160 (patch) | |
| tree | c78ebcd506bbc734123ba875823d49e12965b18f /templates/post/fileinfo.html | |
| parent | 9df6ca8dddb8dabfa30069cdf5f1e0bb45cea793 (diff) | |
| parent | 8aff83bdd4f561e28bd8d2d622263f5c602c7a84 (diff) | |
Merge pull request #70 from Barrucadu/title-injection
Fix unsanitised text vulnerability in post/fileinfo.html
Diffstat (limited to 'templates/post/fileinfo.html')
| -rw-r--r-- | templates/post/fileinfo.html | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/templates/post/fileinfo.html b/templates/post/fileinfo.html index f862f59d..1f3ca4b5 100644 --- a/templates/post/fileinfo.html +++ b/templates/post/fileinfo.html @@ -22,7 +22,7 @@ {% if config.show_filename and file.filename %} , {% if file.filename|length > config.max_filename_display %} - <span class="postfilename" title="{{ file.filename|e }}">{{ file.filename|truncate_filename(config.max_filename_display)|bidi_cleanup }}</span> + <span class="postfilename" title="{{ file.filename|e|bidi_cleanup }}">{{ file.filename|truncate_filename(config.max_filename_display)|bidi_cleanup }}</span> {% else %} <span class="postfilename">{{ file.filename|e|bidi_cleanup }}</span> {% endif %} |