diff options
| author | Jonas Franz <info@jonasfranz.software> | 2018-02-11 17:24:53 +0100 |
|---|---|---|
| committer | Lauris BH <lauris@nix.lv> | 2018-02-11 18:24:53 +0200 |
| commit | ed27da4b0a80ce238db5b4a0bc187a6c8136a4e3 (patch) | |
| tree | 754edaf37307b6a95ecfc8d171751627af11cd15 | |
| parent | 88c363f933be9219574954061c054e40f77e5872 (diff) | |
| download | gitea-ed27da4b0a80ce238db5b4a0bc187a6c8136a4e3.tar.gz gitea-ed27da4b0a80ce238db5b4a0bc187a6c8136a4e3.zip | |
Escape search query (Backport 1.3) (#3489)
* Escape search query
Signed-off-by: Jonas Franz <info@jonasfranz.de>
(cherry picked from commit 2970889)
* Reordered imports
Signed-off-by: Jonas Franz <info@jonasfranz.de>
| -rw-r--r-- | modules/templates/helper.go | 7 | ||||
| -rw-r--r-- | templates/repo/search.tmpl | 2 |
2 files changed, 8 insertions, 1 deletions
diff --git a/modules/templates/helper.go b/modules/templates/helper.go index 67ef1f7b4b..db1323f3dc 100644 --- a/modules/templates/helper.go +++ b/modules/templates/helper.go @@ -9,6 +9,7 @@ import ( "container/list" "encoding/json" "fmt" + "html" "html/template" "mime" "path/filepath" @@ -162,6 +163,7 @@ func NewFuncMap() []template.FuncMap { "UnescapeLocale": func(str string) string { return strings.NewReplacer("\\;", ";", "\\#", "#").Replace(str) }, + "Escape": Escape, }} } @@ -180,6 +182,11 @@ func Str2html(raw string) template.HTML { return template.HTML(markup.Sanitize(raw)) } +// Escape escapes a HTML string +func Escape(raw string) string { + return html.EscapeString(raw) +} + // List traversings the list func List(l *list.List) chan interface{} { e := l.Front() diff --git a/templates/repo/search.tmpl b/templates/repo/search.tmpl index 19a9d4474c..3ddc5de86c 100644 --- a/templates/repo/search.tmpl +++ b/templates/repo/search.tmpl @@ -14,7 +14,7 @@ </div> {{if .Keyword}} <h3> - {{.i18n.Tr "repo.search.results" .Keyword .RepoLink .RepoName | Str2html}} + {{.i18n.Tr "repo.search.results" (.Keyword|Escape) .RepoLink .RepoName | Str2html }} </h3> <div class="repository search"> {{range $result := .SearchResults}} |