Changeset 470

Timestamp:

05/05/20 12:19:08 (4 years ago)

Author:

nanardon

Message:

Fix possible xss injection (Chris Lamb <lamby@…>)

File:

• web/root/templates/html/search/simple_search.tt (modified) (1 diff)

web/root/templates/html/search/simple_search.tt

@@ -2 +2 @@
 <div id="sophie_header_search">
     <form action="[% c.uri_for('/search/results') %]">
-        <input type="text" name="search" value="[% c.req.param('search') %]">
+        <input type="text" name="search" value="[% c.req.param('search') | html %]">
         <input type="image"
             src="[% c.uri_for('/static/images', 'search.png') %]"