track escaping change in upstream template
authorJoey Hess <joey@kitenet.net>
Tue, 27 Sep 2011 14:45:21 +0000 (10:45 -0400)
committerJoey Hess <joey@kitenet.net>
Tue, 27 Sep 2011 15:05:34 +0000 (11:05 -0400)
This is not belived to be XSS exploitable due to other checks in ikiwiki.

Thanks Olly Betts for review.

debian/changelog
templates/searchquery.tmpl

index 34f0ac8..d852c6b 100644 (file)
@@ -1,3 +1,10 @@
+ikiwiki (3.20110906) UNRELEASED; urgency=low
+
+  * searchquery.tmpl: Track escaping change in upstream template.
+    Thanks Olly Betts for review.
+
+ -- Joey Hess <joeyh@debian.org>  Tue, 27 Sep 2011 10:47:13 -0400
+
 ikiwiki (3.20110905) unstable; urgency=low
 
   * mercurial: Openid nicknames are now used when committing. (Daniel Andersson)
index 5b9fbbf..15bc78e 100644 (file)
@@ -70,7 +70,7 @@ $if{$field{language},Language: <b>$html{$field{language}}</b><br>}
 $if{$field{size},<span title="$html{$field{size}} bytes">Size: <b>$html{$filesize{$field{size}}}</b></span><br>}
 </div>
 </td>
-<td><B><A HREF="$field{url}">$html{$or{$field{caption},$field{title},$field{url},Untitled}}</A></B><BR>
+<td><B><A HREF="$html{$field{url}}">$html{$or{$field{caption},$field{title},$field{url},Untitled}}</A></B><BR>
 <small>$highlight{$field{sample},$terms}$if{$field{sample},...}</small><br>
 <small>
 $percentage% relevant$. matching: