From 1ae3c33b7df83cec8afdb5f8e3cc46a0919c9ac1 Mon Sep 17 00:00:00 2001
From: r <r@freesoftwareextremist.com>
Date: Fri, 29 May 2020 10:41:59 +0000
Subject: HTML Escape search queries

---
 templates/search.tmpl     | 2 +-
 templates/usersearch.tmpl | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'templates')

diff --git a/templates/search.tmpl b/templates/search.tmpl
index 560a2c9..11c584a 100644
--- a/templates/search.tmpl
+++ b/templates/search.tmpl
@@ -5,7 +5,7 @@
 <form class="search-form" action="/search" method="GET">
 	<span class="post-form-field>
 		<label for="query"> Query </label>
-		<input id="query" name="q" value="{{.Q}}">
+		<input id="query" name="q" value="{{.Q | HTMLEscape}}">
 	</span>
 	<span class="post-form-field>
 		<label for="type"> Type </label>
diff --git a/templates/usersearch.tmpl b/templates/usersearch.tmpl
index ca99b4c..e5f2bfc 100644
--- a/templates/usersearch.tmpl
+++ b/templates/usersearch.tmpl
@@ -5,7 +5,7 @@
 <form class="search-form" action="/usersearch/{{.User.ID}}" method="GET">
 	<span class="post-form-field>
 		<label for="query"> Query </label>
-		<input id="query" name="q" value="{{.Q}}">
+		<input id="query" name="q" value="{{.Q | HTMLEscape}}">
 	</span>
 	<button type="submit"> Search </button>
 </form>
-- 
cgit v1.2.3