Skip to content

Commit a784ed3

Browse files
wxiaoguangwxiaoguang
authored
Use "Safe" modifier for manually constructed safe HTML strings in templates (go-gitea#29227)
Follow go-gitea#29165. These HTML strings are safe to be rendered directly, to avoid double-escaping.
1 parent d73223b commit a784ed3

File tree

12 files changed

+15
-15
lines changed

12 files changed

+15
-15
lines changed

‎templates/admin/packages/list.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "packages.settings.delete"}}
8989
</div>
9090
<div class="content">
91-
{{ctx.Locale.Tr "packages.settings.delete.notice" `<span class="name"></span>` `<span class="dataVersion"></span>` | Safe}}
91+
{{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|Safe) (`<span class="dataVersion"></span>`|Safe)}}
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/admin/repo/list.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
</div>
102102
<div class="content">
103103
<p>{{ctx.Locale.Tr "repo.settings.delete_desc"}}</p>
104-
{{ctx.Locale.Tr "repo.settings.delete_notices_2" `<span class="name"></span>` | Safe}}<br>
104+
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|Safe)}}<br>
105105
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}<br>
106106
</div>
107107
{{template "base/modal_actions_confirm" .}}

‎templates/admin/stacktrace.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
{{ctx.Locale.Tr "admin.monitor.process.cancel"}}
4040
</div>
4141
<div class="content">
42-
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" `<span class="name"></span>` | Safe}}</p>
42+
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|Safe)}}</p>
4343
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_desc"}}</p>
4444
</div>
4545
{{template "base/modal_actions_confirm" .}}

‎templates/org/member/members.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@
7373
{{ctx.Locale.Tr "org.members.leave"}}
7474
</div>
7575
<div class="content">
76-
<p>{{ctx.Locale.Tr "org.members.leave.detail" `<span class="dataOrganizationName"></span>` | Safe}}</p>
76+
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
7777
</div>
7878
{{template "base/modal_actions_confirm" .}}
7979
</div>
@@ -82,7 +82,7 @@
8282
{{ctx.Locale.Tr "org.members.remove"}}
8383
</div>
8484
<div class="content">
85-
<p>{{ctx.Locale.Tr "org.members.remove.detail" `<span class="name"></span>` `<span class="dataOrganizationName"></span>` | Safe}}</p>
85+
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
8686
</div>
8787
{{template "base/modal_actions_confirm" .}}
8888
</div>

‎templates/org/team/members.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
{{ctx.Locale.Tr "org.members.remove"}}
8282
</div>
8383
<div class="content">
84-
<p>{{ctx.Locale.Tr "org.members.remove.detail" `<span class="name"></span>` `<span class="dataTeamName"></span>` | Safe}}</p>
84+
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataTeamName"></span>`|Safe)}}</p>
8585
</div>
8686
{{template "base/modal_actions_confirm" .}}
8787
</div>

‎templates/org/team/sidebar.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "org.teams.leave"}}
8989
</div>
9090
<div class="content">
91-
<p>{{ctx.Locale.Tr "org.teams.leave.detail" `<span class="name"></span>` | Safe}}</p>
91+
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/org/team/teams.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
{{ctx.Locale.Tr "org.teams.leave"}}
5050
</div>
5151
<div class="content">
52-
<p>{{ctx.Locale.Tr "org.teams.leave.detail" `<span class="name"></span>` | Safe}}</p>
52+
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
5353
</div>
5454
{{template "base/modal_actions_confirm" .}}
5555
</div>

‎templates/repo/commit_page.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{.CsrfTokenHtml}}
8989
<div class="field">
9090
<label>
91-
{{ctx.Locale.Tr "repo.branch.new_branch_from" `<span class="text" id="modal-create-branch-from-span"></span>` | Safe}}
91+
{{ctx.Locale.Tr "repo.branch.new_branch_from" (`<span class="text" id="modal-create-branch-from-span"></span>`|Safe)}}
9292
</label>
9393
</div>
9494
<div class="required field">
@@ -113,7 +113,7 @@
113113
<input type="hidden" name="create_tag" value="true">
114114
<div class="field">
115115
<label>
116-
{{ctx.Locale.Tr "repo.tag.create_tag_from" `<span class="text" id="modal-create-tag-from-span"></span>` | Safe}}
116+
{{ctx.Locale.Tr "repo.tag.create_tag_from" (`<span class="text" id="modal-create-tag-from-span"></span>`|Safe)}}
117117
</label>
118118
</div>
119119
<div class="required field">

‎templates/repo/issue/view_content/comments.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@
112112
{{template "shared/user/authorlink" .Poster}}
113113
{{$link := printf "%s/commit/%s" $.Repository.Link ($.Issue.PullRequest.MergedCommitID|PathEscape)}}
114114
{{if eq $.Issue.PullRequest.Status 3}}
115-
{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID)) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape)) $createdStr | Safe}}
115+
{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
116116
{{else}}
117-
{{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID)) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape)) $createdStr | Safe}}
117+
{{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
118118
{{end}}
119119
</span>
120120
</div>

‎templates/repo/issue/view_content/pull.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
{{ctx.Locale.Tr "repo.pulls.merged_success"}}
3939
</h3>
4040
<div class="merge-section-info">
41-
{{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape)) | Str2html}}
41+
{{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape) | Safe)}}
4242
</div>
4343
</div>
4444
<div class="item-section-right">

0 commit comments

Comments
 (0)