public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 18:35:57 +00:00
Code Issues Releases Wiki Activity

properly escape quotes when rendering article data to html attributes via template strings

Browse Source
This commit is contained in:
Andrew Dolgov
2020-01-18 10:31:00 +03:00
parent 01513aa41b
commit 303f8fb329
2 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
js/Article.js
View File

@@ -156,14 +156,14 @@ define(["dojo/_base/declare"], function (declare) {
comments_msg = hl.num_comments + " " + ngettext("comment", "comments", hl.num_comments)
}
comments = `<a href="${hl.comments}">(${comments_msg})</a>`;
comments = `<a href="${escapeHtml(hl.comments)}">(${comments_msg})</a>`;
}
return comments;
},
formatOriginallyFrom: function(hl) {
return hl.orig_feed ? `<span>
${__('Originally from:')} <a target="_blank" rel="noopener noreferrer" href="${hl.orig_feed[1]}">${hl.orig_feed[0]}</a>
${__('Originally from:')} <a target="_blank" rel="noopener noreferrer" href="${escapeHtml(hl.orig_feed[1])}">${hl.orig_feed[0]}</a>
</span>` : "";
},
unpack: function(row) {
@@ -197,7 +197,9 @@ define(["dojo/_base/declare"], function (declare) {
const article = `<div class="post post-${hl.id}">
<div class="header">
<div class="row">
<div class="title"><a target="_blank" rel="noopener noreferrer" title="${hl.title}" href="${hl.link}">${hl.title}</a></div>
<div class="title"><a target="_blank" rel="noopener noreferrer"
title="${escapeHtml(hl.title)}"
href="${escapeHtml(hl.link)}">${hl.title}</a></div>
<div class="date">${hl.updated_long}</div>
</div>
<div class="row">