Enforce escaping on all template content
This commit is contained in:
@@ -15,12 +15,12 @@ $(document).ready(function() {
|
||||
var table = $('#data-table').dataTable({
|
||||
"deferRender": true,
|
||||
"order": [[ 3, "desc" ]],
|
||||
"data": [% results %],
|
||||
"data": [% results | none %],
|
||||
"columns": [
|
||||
{
|
||||
"data": 'mac',
|
||||
"render": function(data, type, row, meta) {
|
||||
return '<a href="[% search_node %]&q=' + encodeURIComponent(data) + '">' + he.encode(data.toUpperCase()) + '</a>';
|
||||
return '<a href="[% search_node | none %]&q=' + encodeURIComponent(data) + '">' + he.encode(data.toUpperCase()) + '</a>';
|
||||
}
|
||||
}, {
|
||||
"data": 'vendor',
|
||||
@@ -30,7 +30,7 @@ $(document).ready(function() {
|
||||
}, {
|
||||
"data": 'port',
|
||||
"render": function(data, type, row, meta) {
|
||||
return '<a href="[% device_ports %]&q=' + encodeURIComponent(row.switch) + '&f=' + encodeURIComponent(data) + '&c_nodes=on">' + he.encode(row.dns || row.name || row.switch) + '(' + he.encode(data) + ')</a>';
|
||||
return '<a href="[% device_ports | none %]&q=' + encodeURIComponent(row.switch) + '&f=' + encodeURIComponent(data) + '&c_nodes=on">' + he.encode(row.dns || row.name || row.switch) + '(' + he.encode(data) + ')</a>';
|
||||
}
|
||||
}, {
|
||||
"data": 'ip_count',
|
||||
|
||||
Reference in New Issue
Block a user