escaping fix from Emanuele Aina

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 6e1efbd69927f1199b0af6ccee45285d8ef7ea81..be06db49c8d14294a3c2881c1b97f5771ba8aa7f 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -81,7 +81,7 @@ sub cgi_recentchanges ($) { #{{{
        my $changelog=[rcs_recentchanges(100)];
        foreach my $change (@$changelog) {
                $change->{when} = concise(ago($change->{when}));
-               $change->{user} = htmllink("", "", $change->{user}, 1);
+               $change->{user} = htmllink("", "", escapeHTML($change->{user}), 1);
                $change->{pages} = [
                        map {
                                $_->{link} = htmllink("", "", $_->{page}, 1);

diff --git a/templates/recentchanges.tmpl b/templates/recentchanges.tmpl
index f927cf62f4eb9549442f161dd75e4941e0d75764..726e52f6492051e6c7092fa8942c25982c2fd540 100644 (file)
--- a/templates/recentchanges.tmpl
+++ b/templates/recentchanges.tmpl
@@ -30,7 +30,7 @@
 <TMPL_LOOP NAME="CHANGELOG">
        <!-- <TMPL_VAR NAME="REV"> -->
        <tr class="changeinfo">
-               <td class="changeinfo"><TMPL_VAR NAME="USER" ESCAPE="HTML"></td>
+               <td class="changeinfo"><TMPL_VAR NAME="USER"></td>
                <td class="changetime"><TMPL_VAR NAME="WHEN"></td>
                <td class="changeinfo">
                <TMPL_LOOP NAME="PAGES">