From c81ca4c3018090dd510cbb8e94e3e262816acd6a Mon Sep 17 00:00:00 2001
From: jade (winter)
Date: Thu, 16 Apr 2026 15:42:20 +0100
Subject: fix trivial xss in reply form

---
 templates/note/reply_form.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/note/reply_form.php b/templates/note/reply_form.php
index 388b243..1f84133 100644
--- a/templates/note/reply_form.php
+++ b/templates/note/reply_form.php
@@ -31,7 +31,7 @@ $selectedScope = $note->privacy->scope->value;
     <div class="row summaryAndContent">
         <label for="replyContent-<?= $note->id ?>"><?= __('writeReply.label') ?></label>
         <input type="text" id="replySummary-<?= $note->id ?>" name="summary" autocomplete="off"
-            value="<?= $summaryText ?>" placeholder="<?= __('writeNote.summary.label') ?>">
+            value="<?= htmlspecialchars($summaryText) ?>" placeholder="<?= __('writeNote.summary.label') ?>">
         <textarea id="replyContent-<?= $note->id ?>" name="content" required autocomplete="off"
             placeholder="<?= __('writeReply.placeholder') ?>"
             _="on keydown[ctrlKey and key is 'Enter'] set b to #replySubmitButton-<?= $note->id ?> then b.click()"></textarea>
@@ -62,4 +62,4 @@ $selectedScope = $note->privacy->scope->value;
     <div class="row">
         <button class="primary" id="replySubmitButton-<?= $note->id ?>"><?= __('writeReply.action') ?></button>
     </div>
-</form>
\ No newline at end of file
+</form>
-- 
cgit v1.3