Skip to content
This repository has been archived by the owner on Feb 21, 2020. It is now read-only.

Commit

Permalink
escaping html tag attrs in underscore everywhere
Browse files Browse the repository at this point in the history
  • Loading branch information
Eduardo Robles Elvira committed Jan 1, 2014
1 parent 5af3bd8 commit 8f6f3b5
Show file tree
Hide file tree
Showing 33 changed files with 203 additions and 203 deletions.
10 changes: 5 additions & 5 deletions agora_site/agora_core/templates/agora_core/client/action_a_user.html
View file
@@ -1,18 +1,18 @@
<script id="template-action_actor_user" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>
</div>
</div>
Expand Down
18 changes: 9 additions & 9 deletions agora_site/agora_core/templates/agora_core/client/action_ao_agora.html
View file
@@ -1,28 +1,28 @@
<script id="template-action_action_object_agora" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong> <%= pgettext("<verb> agora <agora>", "agora") %>
<a href="<%= action_object.url %>"><%= action_object.full_name %></a>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<a href="<%- action_object.url %>"><%= action_object.full_name %></a>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>

<div class="action-detail">
<a href="<%= action_object.url %>" class="mugshot">
<img src="<%= action_object.mugshot_url %>" alt="<%= escapeAttribute(action_object.full_name) %>" />
<a href="<%- action_object.url %>" class="mugshot">
<img src="<%- action_object.mugshot_url %>" alt="<%- escapeAttribute(action_object.full_name) %>" />
</a>
<div class="detail-body">
<strong class="action-title">
<a href="<%= action_object.url %>">
<a href="<%- action_object.url %>">
<%= action_object.full_name %>
</a>
</strong>
Expand Down
20 changes: 10 additions & 10 deletions agora_site/agora_core/templates/agora_core/client/action_ao_agora_t_user.html
View file
@@ -1,29 +1,29 @@
<script id="template-action_action_object_agora_target_user" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong> <%= pgettext("at agora <agora>", "at agora") %>
<a href="<%= action_object.url %>"><%= action_object.full_name %></a> to
<a href="<%= target.url %>"><%= target.username %></a>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<a href="<%- action_object.url %>"><%= action_object.full_name %></a> to
<a href="<%- target.url %>"><%= target.username %></a>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>

<div class="action-detail">
<a href="<%= action_object.url %>" class="mugshot">
<img src="<%= action_object.mugshot_url %>" alt="<%= escapeAttribute(action_object.full_name) %>" />
<a href="<%- action_object.url %>" class="mugshot">
<img src="<%- action_object.mugshot_url %>" alt="<%- escapeAttribute(action_object.full_name) %>" />
</a>
<div class="detail-body">
<strong class="action-title">
<a href="<%= action_object.url %>">
<a href="<%- action_object.url %>">
<%= action_object.full_name %>
</a>
</strong>
Expand Down
20 changes: 10 additions & 10 deletions agora_site/agora_core/templates/agora_core/client/action_ao_election.html
View file
@@ -1,29 +1,29 @@
<script id="template-action_action_object_election" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong> <%= pgettext("election <election>", "election") %>
<a href="<%= action_object.url %>"><%= action_object.pretty_name %></a> <%= pgettext("<election> at <agora>", "at") %>
<a href="<%= action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<a href="<%- action_object.url %>"><%= action_object.pretty_name %></a> <%= pgettext("<election> at <agora>", "at") %>
<a href="<%- action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>

<div class="action-detail">
<a href="<%= action_object.url %>" class="mugshot">
<img src="<%= action_object.mugshot_url %>" alt="<%= escapeAttribute(action_object.username) %>" />
<a href="<%- action_object.url %>" class="mugshot">
<img src="<%- action_object.mugshot_url %>" alt="<%- escapeAttribute(action_object.username) %>" />
</a>
<div class="detail-body">
<strong class="action-title">
<a href="<%= action_object.url %>">
<a href="<%- action_object.url %>">
<%= action_object.username %>
</a>
</strong>
Expand Down
20 changes: 10 additions & 10 deletions agora_site/agora_core/templates/agora_core/client/action_ao_election_v_voted.html
View file
@@ -1,31 +1,31 @@
<script id="template-action_action_object_election_verb_voted" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong>
<%= pgettext("<verb> on election <election>", "on election") %>
<a href="<%= action_object.url %>"><%= action_object.pretty_name %></a>
<a href="<%- action_object.url %>"><%= action_object.pretty_name %></a>
<%= pgettext("<election> at <agora>", "at") %>
<a href="<%= action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<a href="<%- action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>

<div class="action-detail">
<a href="<%= action_object.url %>" class="mugshot">
<img src="<%= action_object.mugshot_url %>" alt="<%= escapeAttribute(action_object.full_name) %>" />
<a href="<%- action_object.url %>" class="mugshot">
<img src="<%- action_object.mugshot_url %>" alt="<%- escapeAttribute(action_object.full_name) %>" />
</a>
<div class="detail-body">
<strong class="action-title">
<a href="<%= action_object.url %>">
<a href="<%- action_object.url %>">
<%= action_object.pretty_name %>
</a>
</strong>
Expand Down
20 changes: 10 additions & 10 deletions agora_site/agora_core/templates/agora_core/client/action_ao_election_v_voted_public.html
View file
@@ -1,22 +1,22 @@
<script id="template-action_action_object_election_verb_voted_public" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong>
<%= pgettext("<verb> on election <election>", "on election") %>
<a href="<%= action_object.url %>"><%= action_object.pretty_name %></a>
<a href="<%- action_object.url %>"><%= action_object.pretty_name %></a>
<%= pgettext("<election> at <agora>", "at") %>
<a href="<%= action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<a href="<%- action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>
<div class="action-detail">
<div class="detail-body vote">
Expand All @@ -33,12 +33,12 @@
</div>

<div class="action-detail">
<a href="<%= action_object.url %>" class="mugshot">
<img src="<%= action_object.mugshot_url %>" alt="<%= escapeAttribute(action_object.full_name) %>" />
<a href="<%- action_object.url %>" class="mugshot">
<img src="<%- action_object.mugshot_url %>" alt="<%- escapeAttribute(action_object.full_name) %>" />
</a>
<div class="detail-body">
<strong class="action-title">
<a href="<%= action_object.url %>">
<a href="<%- action_object.url %>">
<%= action_object.pretty_name %>
</a>
</strong>
Expand Down
20 changes: 10 additions & 10 deletions ...site/agora_core/templates/agora_core/client/action_ao_election_v_voted_public_reason.html
View file
@@ -1,22 +1,22 @@
<script id="template-action_action_object_election_verb_voted_public_reason" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong>
<%= pgettext("<verb> on election <election>", "on election") %>
<a href="<%= action_object.url %>"><%= action_object.pretty_name %></a>
<a href="<%- action_object.url %>"><%= action_object.pretty_name %></a>
<%= pgettext("<election> at <agora>", "at") %>
<a href="<%= action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<a href="<%- action_object.agora.url %>"><%= action_object.agora.full_name %></a>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>
<div class="action-detail">
<div class="detail-body vote">
Expand All @@ -33,12 +33,12 @@
</div>

<div class="action-detail">
<a href="<%= action_object.url %>" class="mugshot">
<img src="<%= action_object.mugshot_url %>" alt="<%= escapeAttribute(action_object.full_name) %>" />
<a href="<%- action_object.url %>" class="mugshot">
<img src="<%- action_object.mugshot_url %>" alt="<%- escapeAttribute(action_object.full_name) %>" />
</a>
<div class="detail-body">
<strong class="action-title">
<a href="<%= action_object.url %>">
<a href="<%- action_object.url %>">
<%= action_object.pretty_name %>
</a>
</strong>
Expand Down
12 changes: 6 additions & 6 deletions agora_site/agora_core/templates/agora_core/client/action_list.html
View file
Expand Up @@ -2,15 +2,15 @@
<% if (dropdown) { %>
<div class="btn-group">
<a class="btn dropdown-toggle main-action <%= main_action_class %>"
href="#" data-toggle="dropdown" data-id="<%= main_action_id %>">
<i class="<%= main_action_icon %>"></i> <%= main_action_name %>
href="#" data-toggle="dropdown" data-id="<%- main_action_id %>">
<i class="<%- main_action_icon %>"></i> <%= main_action_name %>
<span class="caret"></span>
</a>
<ul class="dropdown-menu">
<% for (var i = 0; i < actions.length; i++) { %>
<li>
<a href="#" data-id="<%= actions[i].id %>" class="action-link">
<i class="<%= actions[i].icon %>"></i>
<a href="#" data-id="<%- actions[i].id %>" class="action-link">
<i class="<%- actions[i].icon %>"></i>
<%= actions[i].name %>
</a>
</li>
Expand All @@ -19,8 +19,8 @@
</div>
<% } else { %>
<a class="btn main-action action-link <%= main_action_class %>" href="#"
data-id="<%= main_action_id %>">
<i class="<%= main_action_icon %>"></i> <%= main_action_name %>
data-id="<%- main_action_id %>">
<i class="<%- main_action_icon %>"></i> <%= main_action_name %>
</a>
<% } %>
</script>
10 changes: 5 additions & 5 deletions agora_site/agora_core/templates/agora_core/client/action_single_user.html
View file
@@ -1,18 +1,18 @@
<script id="template-action_single_user" type="text/underscore-template">
<div class="activity-action" geodata="<%= geolocation %>">
<a href="<%= actor.url %>" class="mugshot">
<img src="<%= actor.mugshot_url %>" alt="<%= escapeAttribute(actor.initials) %>" />
<div class="activity-action" geodata="<%- geolocation %>">
<a href="<%- actor.url %>" class="mugshot">
<img src="<%- actor.mugshot_url %>" alt="<%- escapeAttribute(actor.initials) %>" />
</a>
<div class="action-body">
<div class="action-title">
<a href="<%= actor.url %>"><strong class="username">
<a href="<%- actor.url %>"><strong class="username">
<% if (actor.full_name && actor.full_name != actor.username) { %>
<%= actor.full_name %> <em>(<%= actor.username %>)</em>
<% } else { %>
<%= actor.username %>
<% } %>
</strong></a> <strong class="verb"><%= gettext(verb) %></strong>
<time class="timeago" data-livestamp="<%= timestamp %>" datetime="<%= timestamp %>"></time>
<time class="timeago" data-livestamp="<%- timestamp %>" datetime="<%- timestamp %>"></time>
</div>
</div>
</div>
Expand Down

0 comments on commit 8f6f3b5

Please sign in to comment.