commit 37a65a761afa5a62630c620ac00f42a228604df7 Author: Iain R. Learmonth irl@fsfe.org Date: Mon Dec 11 15:13:19 2017 +0000
Escape contact information before display in template --- templates/details/router.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/templates/details/router.html b/templates/details/router.html index 2aea6b2..c9f79d5 100644 --- a/templates/details/router.html +++ b/templates/details/router.html @@ -24,7 +24,7 @@ <dd><%= relay.get('or_addresses') %></dd>
<dt><span class="tip" title="These are the contact details of the Tor relay operator">Contact</span></dt> - <dd><%= _.escape( relay.get('contact')!='undefined' ? relay.get('contact') : 'none' ) %></dd> + <dd><%= _.escape( relay.get('contact')!='undefined' ? _.escape(relay.get('contact')) : 'none' ) %></dd>
<dt><span class="tip" title="Address and port where the relay listens for directory requests.">Dir Address</span></dt> <dd><%= relay.get('dir_address') ? relay.get('dir_address') : 'none' %></dd>