html/messages.tmpl: Fix XSS vulneralibility

[deb/packages.git] / templates / html / messages.tmpl

diff --git a/templates/html/messages.tmpl b/templates/html/messages.tmpl
index 3d8b6a680c2fc98068cca2513de0fadf91721466..7c9c6117700d817f0467fd22be9e784b630a9191 100644 (file)
--- a/templates/html/messages.tmpl
+++ b/templates/html/messages.tmpl
@@ -1,31 +1,31 @@
 <!-- messages.tmpl -->
 [%- FOREACH error IN errors %]
 [%- '<div class="perror">' IF loop.first %]
 <!-- messages.tmpl -->
 [%- FOREACH error IN errors %]
 [%- '<div class="perror">' IF loop.first %]

- <p>[% error %]</p>
+ <p>[% error | html %]</p>

 [% '</div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH debug IN debugs %]
 [%- '<div class="pdebug"><h2>Debugging:</h2><pre>' IF loop.first -%]
 [% '</div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH debug IN debugs %]
 [%- '<div class="pdebug"><h2>Debugging:</h2><pre>' IF loop.first -%]

-[% debug %]
+[% debug | html %]

 [% '</pre></div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH hint IN hints %]
 [%- '<div class="phints">' IF loop.first %]
 [% '</pre></div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH hint IN hints %]
 [%- '<div class="phints">' IF loop.first %]

- <p>[% hint %]</p>
+ <p>[% hint | html %]</p>

 [% '</div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH msg IN msgs %]
 [%- '<div class="pmsgs">' IF loop.first %]
 [% '</div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH msg IN msgs %]
 [%- '<div class="pmsgs">' IF loop.first %]

- <p>[% msg %]</p>
+ <p>[% msg | html %]</p>

 [% '</div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH note IN notes %]
 [%- '<div class="pnotes">' IF loop.first %]
 [%- IF note.1 %]
 [% '</div>' IF loop.last -%]
 [% END -%]
 [%- FOREACH note IN notes %]
 [%- '<div class="pnotes">' IF loop.first %]
 [%- IF note.1 %]

- <h2>[% note.0 %]</h2>
- <p>[% note.1 %]</p>
+ <h2>[% note.0 | html %]</h2>
+ <p>[% note.1 | html %]</p>

 [% ELSE %]
 [% ELSE %]

- <p>[% note.0 %]</p>
+ <p>[% note.0 | html %]</p>

 [% END -%]
 [% '</div>' IF loop.last -%]
 [% END -%]
 [% END -%]
 [% '</div>' IF loop.last -%]
 [% END -%]