Skip to content

Commit 15278e4

Browse files
wxiaoguangsilverwind
wxiaoguang
authored and
silverwind
committed
Use "Safe" modifier for manually constructed safe HTML strings in templates (go-gitea#29227)
Follow go-gitea#29165. These HTML strings are safe to be rendered directly, to avoid double-escaping.
1 parent d2c724f commit 15278e4

File tree

12 files changed

+15
-15
lines changed

12 files changed

+15
-15
lines changed

‎templates/admin/packages/list.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "packages.settings.delete"}}
8989
</div>
9090
<div class="content">
91-
{{ctx.Locale.Tr "packages.settings.delete.notice" `<span class="name"></span>` `<span class="dataVersion"></span>` | Safe}}
91+
{{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|Safe) (`<span class="dataVersion"></span>`|Safe)}}
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/admin/repo/list.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
</div>
102102
<div class="content">
103103
<p>{{ctx.Locale.Tr "repo.settings.delete_desc"}}</p>
104-
{{ctx.Locale.Tr "repo.settings.delete_notices_2" `<span class="name"></span>` | Safe}}<br>
104+
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|Safe)}}<br>
105105
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}<br>
106106
</div>
107107
{{template "base/modal_actions_confirm" .}}

‎templates/admin/stacktrace.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
{{ctx.Locale.Tr "admin.monitor.process.cancel"}}
4040
</div>
4141
<div class="content">
42-
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" `<span class="name"></span>` | Safe}}</p>
42+
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|Safe)}}</p>
4343
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_desc"}}</p>
4444
</div>
4545
{{template "base/modal_actions_confirm" .}}

‎templates/org/member/members.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@
7373
{{ctx.Locale.Tr "org.members.leave"}}
7474
</div>
7575
<div class="content">
76-
<p>{{ctx.Locale.Tr "org.members.leave.detail" `<span class="dataOrganizationName"></span>` | Safe}}</p>
76+
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
7777
</div>
7878
{{template "base/modal_actions_confirm" .}}
7979
</div>
@@ -82,7 +82,7 @@
8282
{{ctx.Locale.Tr "org.members.remove"}}
8383
</div>
8484
<div class="content">
85-
<p>{{ctx.Locale.Tr "org.members.remove.detail" `<span class="name"></span>` `<span class="dataOrganizationName"></span>` | Safe}}</p>
85+
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
8686
</div>
8787
{{template "base/modal_actions_confirm" .}}
8888
</div>

‎templates/org/team/members.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
{{ctx.Locale.Tr "org.members.remove"}}
8282
</div>
8383
<div class="content">
84-
<p>{{ctx.Locale.Tr "org.members.remove.detail" `<span class="name"></span>` `<span class="dataTeamName"></span>` | Safe}}</p>
84+
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataTeamName"></span>`|Safe)}}</p>
8585
</div>
8686
{{template "base/modal_actions_confirm" .}}
8787
</div>

‎templates/org/team/sidebar.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "org.teams.leave"}}
8989
</div>
9090
<div class="content">
91-
<p>{{ctx.Locale.Tr "org.teams.leave.detail" `<span class="name"></span>` | Safe}}</p>
91+
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/org/team/teams.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
{{ctx.Locale.Tr "org.teams.leave"}}
5050
</div>
5151
<div class="content">
52-
<p>{{ctx.Locale.Tr "org.teams.leave.detail" `<span class="name"></span>` | Safe}}</p>
52+
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
5353
</div>
5454
{{template "base/modal_actions_confirm" .}}
5555
</div>

‎templates/repo/commit_page.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{.CsrfTokenHtml}}
8989
<div class="field">
9090
<label>
91-
{{ctx.Locale.Tr "repo.branch.new_branch_from" `<span class="text" id="modal-create-branch-from-span"></span>` | Safe}}
91+
{{ctx.Locale.Tr "repo.branch.new_branch_from" (`<span class="text" id="modal-create-branch-from-span"></span>`|Safe)}}
9292
</label>
9393
</div>
9494
<div class="required field">
@@ -113,7 +113,7 @@
113113
<input type="hidden" name="create_tag" value="true">
114114
<div class="field">
115115
<label>
116-
{{ctx.Locale.Tr "repo.tag.create_tag_from" `<span class="text" id="modal-create-tag-from-span"></span>` | Safe}}
116+
{{ctx.Locale.Tr "repo.tag.create_tag_from" (`<span class="text" id="modal-create-tag-from-span"></span>`|Safe)}}
117117
</label>
118118
</div>
119119
<div class="required field">

‎templates/repo/issue/view_content/comments.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@
112112
{{template "shared/user/authorlink" .Poster}}
113113
{{$link := printf "%s/commit/%s" $.Repository.Link ($.Issue.PullRequest.MergedCommitID|PathEscape)}}
114114
{{if eq $.Issue.PullRequest.Status 3}}
115-
{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID)) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape)) $createdStr | Safe}}
115+
{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
116116
{{else}}
117-
{{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID)) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape)) $createdStr | Safe}}
117+
{{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
118118
{{end}}
119119
</span>
120120
</div>

‎templates/repo/issue/view_content/pull.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
{{ctx.Locale.Tr "repo.pulls.merged_success"}}
3939
</h3>
4040
<div class="merge-section-info">
41-
{{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape)) | Str2html}}
41+
{{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape) | Safe)}}
4242
</div>
4343
</div>
4444
<div class="item-section-right">

‎templates/repo/settings/webhook/settings.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,7 @@
263263
<label for="authorization_header">{{ctx.Locale.Tr "repo.settings.authorization_header"}}</label>
264264
<input id="authorization_header" name="authorization_header" type="text" value="{{.Webhook.HeaderAuthorization}}"{{if eq .HookType "matrix"}} placeholder="Bearer $access_token" required{{end}}>
265265
{{if ne .HookType "matrix"}}{{/* Matrix doesn't make the authorization optional but it is implied by the help string, should be changed.*/}}
266-
<span class="help">{{ctx.Locale.Tr "repo.settings.authorization_header_desc" "<code>Bearer token123456</code>, <code>Basic YWxhZGRpbjpvcGVuc2VzYW1l</code>" | Str2html}}</span>
266+
<span class="help">{{ctx.Locale.Tr "repo.settings.authorization_header_desc" ("<code>Bearer token123456</code>, <code>Basic YWxhZGRpbjpvcGVuc2VzYW1l</code>" | Safe)}}</span>
267267
{{end}}
268268
</div>
269269

‎templates/user/settings/organization.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
{{ctx.Locale.Tr "org.members.leave"}}
4848
</div>
4949
<div class="content">
50-
<p>{{ctx.Locale.Tr "org.members.leave.detail" `<span class="dataOrganizationName"></span>` | Safe}}</p>
50+
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
5151
</div>
5252
{{template "base/modal_actions_confirm" .}}
5353
</div>

0 commit comments

Comments
 (0)