[tor-commits] [atlas/master] Escape contact information before display in template

[irl@xxxxxxxxxxxxxx]

commit 37a65a761afa5a62630c620ac00f42a228604df7
Author: Iain R. Learmonth <irl@xxxxxxxx>
Date:   Mon Dec 11 15:13:19 2017 +0000

    Escape contact information before display in template
---
 templates/details/router.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/details/router.html b/templates/details/router.html
index 2aea6b2..c9f79d5 100644
--- a/templates/details/router.html
+++ b/templates/details/router.html
@@ -24,7 +24,7 @@
       <dd><%= relay.get('or_addresses') %></dd>
 
       <dt><span class="tip" title="These are the contact details of the Tor relay operator">Contact</span></dt>
-      <dd><%= _.escape( relay.get('contact')!='undefined' ? relay.get('contact') : 'none' ) %></dd>
+      <dd><%= _.escape( relay.get('contact')!='undefined' ? _.escape(relay.get('contact')) : 'none' ) %></dd>
 
       <dt><span class="tip" title="Address and port where the relay listens for directory requests.">Dir Address</span></dt>
       <dd><%= relay.get('dir_address') ? relay.get('dir_address') : 'none' %></dd>



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits