added fixed for XSS holes (fixes #93)

rodnaph · May 8, 2012 · fe2d895 · fe2d895
1 parent 18fee9b
commit fe2d895
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon b/templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon
@@ -23,11 +23,11 @@
     Vector<User> recentUsers = null;
 </%args>
 
-<& ../IHeader; properties=properties; title="Playlist: " + playlist.getName(); user=user; locale=locale; &>
+<& ../IHeader; properties=properties; title="Playlist: " + Utils.XMLEncode(playlist.getName()); user=user; locale=locale; &>
 
 <h2>
     <div class="links">
-        <% Utils.u2e(playlist.getName()) #n %>
+        <% Utils.XMLEncode(playlist.getName()) #n %>
         <div class="links">
             <& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); shareLink=true; playRandomLink=true; locale=locale; properties=properties; &>
         </div>

diff --git a/templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon b/templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon
@@ -53,12 +53,12 @@
         <%for Playlist playlist : userPlaylists %>
             <li class="playlist" id="userPlaylist<% playlist.getId() %>">
                 <& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); locale=locale; properties=properties; &>
-                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.u2e(playlist.getName()) #n %></a>
+                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.XMLEncode(playlist.getName()) #n %></a>
                 by
                 <%if user != null && (user.getId() == playlist.getUser().getId()) %>
                     <b>you</b>
                 <%else>
-                    <% Utils.u2e(playlist.getUser().getName()) #n %>
+                    <% Utils.XMLEncode(playlist.getUser().getName()) #n %>
                 </%if>
                 (<% playlist.getTrackCount() %> track<%if playlist.getTrackCount() != 1 %>s</%if>)
                 <%if user != null && (playlist.getUser().getId() == user.getId()) %>