From 413b76885f6033da097c9474c1e9367bcb8969b5 Mon Sep 17 00:00:00 2001
From: Ted Trask <ttrask01@yahoo.com>
Date: Wed, 3 Sep 2008 13:53:55 +0000
Subject: Modified filedetails view to HTML escape the filecontent before
 displaying it.

git-svn-id: svn://svn.alpinelinux.org/acf/core/trunk@1443 ab2d0c66-481e-0410-8bed-d214d4d58bed
---
 app/filedetails-html.lsp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/filedetails-html.lsp b/app/filedetails-html.lsp
index b7d392c..5b51500 100644
--- a/app/filedetails-html.lsp
+++ b/app/filedetails-html.lsp
@@ -22,7 +22,7 @@ displayitem(form.value.mtime)
 <form action="<%= page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action %>" method="POST">
 <input type="hidden" name="filename" value="<%= form.value.filename.value %>">
 <textarea name="filecontent">
-<%= form.value.filecontent.value %>
+<%= html.html_escape(form.value.filecontent.value) %>
 </textarea>
 <% if form.value.filecontent.errtxt then %><P CLASS='error'><%= string.gsub(form.value.filecontent.errtxt, "\n", "<BR>") %></P><% end %>
 
-- 
cgit v1.2.3