mirror of
https://github.com/iv-org/invidious.git
synced 2024-09-02 00:00:41 +02:00
Fix XSS in title and input bar
This commit is contained in:
parent
1ea563f4f1
commit
28f564ee4c
|
@ -1,5 +1,5 @@
|
|||
<% content_for "header" do %>
|
||||
<title><%= search_query.not_nil!.size > 30 ? query.not_nil![0,30].rstrip(".") + "..." : query.not_nil! %> - Invidious</title>
|
||||
<title><%= search_query.not_nil!.size > 30 ? HTML.escape(query.not_nil![0,30].rstrip(".") + "...") : HTML.escape(query.not_nil!) %> - Invidious</title>
|
||||
<% end %>
|
||||
|
||||
<% videos.each_slice(4) do |slice| %>
|
||||
|
|
|
@ -35,7 +35,7 @@
|
|||
<div class="pure-u-1 pure-u-md-12-24 searchbar">
|
||||
<form class="pure-form" action="/search" method="get">
|
||||
<fieldset>
|
||||
<input type="search" style="width:100%;" name="q" placeholder="search" value="<%= env.params.query["q"]?.try {|x| HTML.escape(x)} || env.get?("search").try {|x| HTML.escape(x.as(String)) } %>">
|
||||
<input type="search" style="width:100%;" name="q" placeholder="search" value="<%= env.get?("search").try {|x| HTML.escape(x.as(String)) } || env.params.query["q"]?.try {|x| HTML.escape(x)} %>">
|
||||
</fieldset>
|
||||
</form>
|
||||
</div>
|
||||
|
|
Loading…
Reference in New Issue
Block a user