diff options
| author | Unknwon <u@gogs.io> | 2018-09-28 23:56:45 -0400 |
|---|---|---|
| committer | Unknwon <u@gogs.io> | 2018-09-28 23:56:45 -0400 |
| commit | 0d66b1cc1c8c44c041f5274f967535d62bd371e1 (patch) | |
| tree | 2d1cc270322f9a03768da18e55f12e65ec7a2511 /templates/repo | |
| parent | 1843354d88b4998a93fc0165ccca760977be3e73 (diff) | |
pkg/context: apply EscapePound at context level
Always escape template variable {{.Link}} variable and redirect calls.
Relates to #5442
Diffstat (limited to 'templates/repo')
| -rw-r--r-- | templates/repo/issue/new_form.tmpl | 2 | ||||
| -rw-r--r-- | templates/repo/settings/protected_branch.tmpl | 4 | ||||
| -rw-r--r-- | templates/repo/wiki/new.tmpl | 2 |
3 files changed, 4 insertions, 4 deletions
diff --git a/templates/repo/issue/new_form.tmpl b/templates/repo/issue/new_form.tmpl index d3f9f710..c2f215e2 100644 --- a/templates/repo/issue/new_form.tmpl +++ b/templates/repo/issue/new_form.tmpl @@ -1,4 +1,4 @@ -<form class="ui comment form grid" action="{{EscapePound .Link}}" method="post"> +<form class="ui comment form grid" action="{{.Link}}" method="post"> {{.CSRFTokenHTML}} {{if .Flash}} <div class="sixteen wide column"> diff --git a/templates/repo/settings/protected_branch.tmpl b/templates/repo/settings/protected_branch.tmpl index 10495718..e9367fe0 100644 --- a/templates/repo/settings/protected_branch.tmpl +++ b/templates/repo/settings/protected_branch.tmpl @@ -11,7 +11,7 @@ </h4> <div class="ui attached segment branch-protection"> <p>{{.i18n.Tr "repo.settings.branch_protection_desc" .Branch.Name | Str2html}}</p> - <form class="ui form" action="{{EscapePound .Link}}" method="post"> + <form class="ui form" action="{{.Link}}" method="post"> {{.CSRFTokenHTML}} <div class="inline field"> <div class="ui checkbox"> @@ -83,4 +83,4 @@ </div> </div> </div> -{{template "base/footer" .}}
\ No newline at end of file +{{template "base/footer" .}} diff --git a/templates/repo/wiki/new.tmpl b/templates/repo/wiki/new.tmpl index 74069758..13ba3b9f 100644 --- a/templates/repo/wiki/new.tmpl +++ b/templates/repo/wiki/new.tmpl @@ -11,7 +11,7 @@ </div> {{end}} </div> - <form class="ui form" action="{{EscapePound .Link}}" method="post"> + <form class="ui form" action="{{.Link}}" method="post"> {{.CSRFTokenHTML}} <input type="hidden" name="old_title" value="{{.old_title}}"> <div class="field {{if .Err_Title}}error{{end}}"> |