From b727e0be71647c72124d64108c913e4a5bec156b Mon Sep 17 00:00:00 2001
From: Unknwon <u@gogs.io>
Date: Sun, 15 Oct 2017 00:07:46 -0400
Subject: SECURITY: fix branch name persistent XSS

Reported by Carl Hattenfels.
---
 templates/repo/editor/commit_form.tmpl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'templates/repo/editor')

diff --git a/templates/repo/editor/commit_form.tmpl b/templates/repo/editor/commit_form.tmpl
index 6aee9f1d..6ee6300f 100644
--- a/templates/repo/editor/commit_form.tmpl
+++ b/templates/repo/editor/commit_form.tmpl
@@ -14,7 +14,8 @@
 					<input type="radio" class="js-quick-pull-choice-option" name="commit_choice" value="direct" {{if eq .commit_choice "direct"}}checked{{end}}>
 					<label>
 						<i class="octicon octicon-git-commit" height="16" width="14"></i>
-						{{.i18n.Tr "repo.editor.commit_directly_to_this_branch" .BranchName | Safe}}
+						{{$branchName := .BranchName | Str2html}}
+						{{.i18n.Tr "repo.editor.commit_directly_to_this_branch" $branchName | Safe}}
 					</label>
 				</div>
 			</div>
-- 
cgit v1.2.3