deblan-mirror/thelounge
deblan-mirror/thelounge
1
0
Fork 0
mirror of https://github.com/thelounge/thelounge.git synced 2024-06-09 17:22:25 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #455 from ohaal/master

Browse source 
Fix XSS vulnerability
This commit is contained in:
Mattias Erming 2015-09-18 22:06:05 +02:00
parent 2cee0ea6ef 5656244e60
commit e0e20e5eef
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
client/js/shout.templates.js
View file

@ -160,7 +160,7 @@ templates['toggle'] = template({"1":function(depth0,helpers,partials,data) {
stack1 = helpers['if'].call(depth0, (depth0 != null ? depth0.thumb : depth0), {"name":"if","hash":{},"fn":this.program(5, data),"inverse":this.noop,"data":data});
if (stack1 != null) { buffer += stack1; }
buffer += " <div class=\"head\">";
stack1 = ((helper = (helper = helpers.head || (depth0 != null ? depth0.head : depth0)) != null ? helper : helperMissing),(typeof helper === functionType ? helper.call(depth0, {"name":"head","hash":{},"data":data}) : helper));
stack1 = ((helpers.parse || (depth0 && depth0.parse) || helperMissing).call(depth0, (depth0 != null ? depth0.head : depth0), {"name":"parse","hash":{},"data":data}));
if (stack1 != null) { buffer += stack1; }
return buffer + "</div>\n <div class=\"body\">\n "
+ escapeExpression(((helper = (helper = helpers.body || (depth0 != null ? depth0.body : depth0)) != null ? helper : helperMissing),(typeof helper === functionType ? helper.call(depth0, {"name":"body","hash":{},"data":data}) : helper)))

2
client/views/toggle.tpl
View file

@ -9,7 +9,7 @@
{{#if thumb}}
<img src="{{thumb}}" class="thumb">
{{/if}}
<div class="head">{{{head}}}</div>
<div class="head">{{{parse head}}}</div>
<div class="body">
{{body}}
</div>