From eba01998e1a0d9172feb30fca0e73c74f4009582 Mon Sep 17 00:00:00 2001 From: cel Date: Mon, 11 Mar 2019 16:47:41 -1000 Subject: Escape draft edit URL --- lib/serve.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/serve.js') diff --git a/lib/serve.js b/lib/serve.js index 9ef292a..0410a92 100644 --- a/lib/serve.js +++ b/lib/serve.js @@ -4271,7 +4271,7 @@ Serve.prototype.drafts = function (path) { + (form.composer_id ? '#' + encodeURIComponent(form.composer_id) : '') cb(null, ph('div', [ ph('table', ph('tr', [ - ph('td', ph('form', {method: 'post', action: composerUrl}, [ + ph('td', ph('form', {method: 'post', action: u.escapeHTML(composerUrl)}, [ hiddenInput('draft_id', id), hiddenInput('restored_draft', '1'), Object.keys(form).map(function (key) { -- cgit v1.2.3