URI and HTML escape template variables

2013-03-02 18:18:46 +00:00
parent 043eef9d4d
commit 8e9466b64f
19 changed files with 135 additions and 133 deletions
--- a/Netdisco/share/views/search.tt
+++ b/Netdisco/share/views/search.tt
@@ -17,7 +17,7 @@
            <script type="text/javascript">has_sidebar["[% tab.id %]"] = 1;</script>
            [% CATCH %]
            <!-- no "[% tab.id %]" search options -->
-            <input name="q" value="[% params.q %]" type="hidden"/>
+            <input name="q" value="[% params.q | html_entity %]" type="hidden"/>
            <script type="text/javascript">has_sidebar["[% tab.id %]"] = 0;</script>
            [% END %]
          </form>