fileboard: fix possible XSS (mainly applicable to 8chan)

2015-04-23 03:45:08 +02:00
parent b5370fd3e5
commit 271dcb7a65
2 changed files with 2 additions and 2 deletions
--- a/templates/post_form.html
+++ b/templates/post_form.html
@@ -98,7 +98,7 @@
 				<td>
 					<select name="tag">
 						{% for id, tag in config.allowed_tags %}
-							<option value="{{ id }}">{{ tag }}</option>
+							<option value="{{ id|e }}">{{ tag|e }}</option>
 						{% endfor %}
 					</select>
 				</td>