diff options
| author | justdave%syndicomm.com <> | 2003-04-25 05:49:27 +0200 |
|---|---|---|
| committer | justdave%syndicomm.com <> | 2003-04-25 05:49:27 +0200 |
| commit | 29021b187f042f023584dd3986c086ca68bef0a2 (patch) | |
| tree | d6c1c7c114ffe92462ef4f1817c6a87f18e4141c /template/en/default/list/list.html.tmpl | |
| parent | 2fac94504175f4964ad254f07e184e00e10eef08 (diff) | |
| download | bugzilla-29021b187f042f023584dd3986c086ca68bef0a2.tar.gz bugzilla-29021b187f042f023584dd3986c086ca68bef0a2.tar.xz | |
Bug 192677: Add new test to flag failure-to-filter situations in the templates, and correct the XSS holes that were discovered as a
result of it.
Patch by Gervase Markham <gerv@mozilla.org>
r= myk, bbaetz, justdave
a= justdave
Diffstat (limited to 'template/en/default/list/list.html.tmpl')
| -rw-r--r-- | template/en/default/list/list.html.tmpl | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/template/en/default/list/list.html.tmpl b/template/en/default/list/list.html.tmpl index 9b9f099d3..91a5584cf 100644 --- a/template/en/default/list/list.html.tmpl +++ b/template/en/default/list/list.html.tmpl @@ -95,7 +95,7 @@ <p> <a href="query.cgi">Query Page</a> <a href="enter_bug.cgi">Enter New Bug</a> - <a href="query.cgi?[% urlquerypart %]">Edit this query</a> + <a href="query.cgi?[% urlquerypart FILTER html %]">Edit this query</a> </p> [% ELSIF bugs.size == 1 %] @@ -133,11 +133,13 @@ <input type="hidden" name="buglist" value="[% buglist %]"> <input type="submit" value="Long Format"> - <a href="buglist.cgi?[% urlquerypart %]&ctype=csv">CSV</a> - <a href="colchange.cgi?[% urlquerypart %]">Change Columns</a> + <a href="buglist.cgi? + [% urlquerypart FILTER html %]&ctype=csv">CSV</a> + <a href="colchange.cgi? + [% urlquerypart FILTER html %]">Change Columns</a> [% IF bugs.size > 1 && caneditbugs && !dotweak %] - <a href="buglist.cgi?[% urlquerypart %] + <a href="buglist.cgi?[% urlquerypart FILTER html %] [%- "&order=$qorder" FILTER html IF order %]&tweak=1">Change Several Bugs at Once</a> @@ -147,7 +149,8 @@ <a href="mailto:[% bugowners %]">Send Mail to Bug Owners</a> [% END %] - <a href="query.cgi?[% urlquerypart %]">Edit this Query</a> + <a href="query.cgi? + [% urlquerypart FILTER html %]">Edit this Query</a> </form> |