Also escape quotes. Fix XSS bug.

0day1day · Aug 31, 2012 · c0f1898 · c0f1898
1 parent b90063f
commit c0f1898
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/website/master.py b/website/master.py
@@ -130,7 +130,7 @@ def escape(self, var):
         """
             Escape input
         """
-        return cgi.escape(var)
+        return cgi.escape(var, True)
 
     def reset_if_empty(self, to_check = None):
         """