diff options
| author | nickolas360 <contact@nickolas360.com> | 2018-06-10 11:42:16 -0700 |
|---|---|---|
| committer | Lauris BH <lauris@nix.lv> | 2018-06-10 21:42:16 +0300 |
| commit | 2bb73fe12c1377f133192afd40197d897558de63 (patch) | |
| tree | de20da680b2e09ea505d2ec54f840bba92eaf10f /routers/repo | |
| parent | af57d6ab8a5a1f0f8bb3f52a081736c8c57cbd72 (diff) | |
| download | gitea-2bb73fe12c1377f133192afd40197d897558de63.tar.gz gitea-2bb73fe12c1377f133192afd40197d897558de63.zip | |
HTML-escape text READMEs (#4192)
Diffstat (limited to 'routers/repo')
| -rw-r--r-- | routers/repo/view.go | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/routers/repo/view.go b/routers/repo/view.go index d2efe30096..4f1deeae40 100644 --- a/routers/repo/view.go +++ b/routers/repo/view.go @@ -105,7 +105,9 @@ func renderDirectory(ctx *context.Context, treeLink string) { ctx.Data["FileContent"] = string(markup.Render(readmeFile.Name(), buf, treeLink, ctx.Repo.Repository.ComposeMetas())) } else { ctx.Data["IsRenderedHTML"] = true - ctx.Data["FileContent"] = string(bytes.Replace(buf, []byte("\n"), []byte(`<br>`), -1)) + ctx.Data["FileContent"] = strings.Replace( + gotemplate.HTMLEscapeString(string(buf)), "\n", `<br>`, -1, + ) } } } @@ -208,7 +210,9 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry, treeLink, rawLink st ctx.Data["FileContent"] = string(markup.Render(blob.Name(), buf, path.Dir(treeLink), ctx.Repo.Repository.ComposeMetas())) } else if readmeExist { ctx.Data["IsRenderedHTML"] = true - ctx.Data["FileContent"] = string(bytes.Replace(buf, []byte("\n"), []byte(`<br>`), -1)) + ctx.Data["FileContent"] = strings.Replace( + gotemplate.HTMLEscapeString(string(buf)), "\n", `<br>`, -1, + ) } else { // Building code view blocks with line number on server side. var fileContent string |