From 75cdda9bf768914e72e1d72b720d8b44566d3f6f Mon Sep 17 00:00:00 2001
From: robmadole <robmadole@gmail.com>
Date: Mon, 21 Nov 2016 10:35:14 -0600
Subject: [PATCH] Fix script injection by using _.template escaping

---
 src/icons.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/icons.html b/src/icons.html
index 00ad17e74..85534b2dd 100644
--- a/src/icons.html
+++ b/src/icons.html
@@ -57,7 +57,7 @@ relative_path: ../
     {% include icons/medical.html %}
   </div>
   <script type="text/template" id="results-template">
-    <h2 class="page-header">Search for '<span class="text-color-default"><%= content.query %></span>'</h2>
+    <h2 class="page-header">Search for '<span class="text-color-default"><%- content.query %></span>'</h2>
     <% if (content.nbHits > 0) { %>
       <div class="row fontawesome-icon-list">
         <%= results %>