From ae5b7386ada89db2dcfac1639a25e9ad3bce7c81 Mon Sep 17 00:00:00 2001
From: Ted Trask <ttrask01@yahoo.com>
Date: Thu, 15 Jan 2009 21:44:39 +0000
Subject: Modified html.lua and viewlibrary.lua and all html files to
 html_escape variables before displaying them.

git-svn-id: svn://svn.alpinelinux.org/acf/dansguardian/trunk@1678 ab2d0c66-481e-0410-8bed-d214d4d58bed
---
 dansguardian-html.lsp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dansguardian-html.lsp b/dansguardian-html.lsp
index 83a17d3..a84b6ad 100644
--- a/dansguardian-html.lsp
+++ b/dansguardian-html.lsp
@@ -26,7 +26,7 @@ end %>
 
 <%
    for k,v in ipairs( view.value ) do
-      io.write( "<tr><td><a href=\"" .. page_info.script .. page_info.prefix .. page_info.controller .. "/edit?filename=" .. v.filename .. "&redir=" .. page_info.orig_action .. "\">" .. v.filename .. "</a></td><td>" .. v.size .."</td><td>" .. v.mtime .."</td></tr>\n" )
+      io.write( "<tr><td><a href=\"" .. html.html_escape(page_info.script .. page_info.prefix .. page_info.controller) .. "/edit?filename=" .. html.html_escape(v.filename) .. "&redir=" .. html.html_escape(page_info.orig_action) .. "\">" .. html.html_escape(v.filename) .. "</a></td><td>" .. html.html_escape(v.size) .."</td><td>" .. html.html_escape(v.mtime) .."</td></tr>\n" )
    end
 %>
 </TABLE>
-- 
cgit v1.2.3