From fb4cbc73bae831e68fe8234811184f46077db5e6 Mon Sep 17 00:00:00 2001
From: winter
Date: Mon, 20 Jan 2025 17:48:33 +0000
Subject: fix some xss situations

---
 templates/note.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'templates/note.php')

diff --git a/templates/note.php b/templates/note.php
index 98581c8..3e978b9 100644
--- a/templates/note.php
+++ b/templates/note.php
@@ -20,7 +20,8 @@ if ($user != null) {
     <div>
 
         <div class="infoLine">
-            <a class="authorName" href="/@/<?= $note->author->getFullHandle() ?>"><?= $note->author->displayName ?></a>
+            <a class="authorName"
+                href="/@/<?= $note->author->getFullHandle() ?>"><?= htmlspecialchars($note->author->displayName) ?></a>
             <span class="authorHandle">@<?= $note->author->getFullHandle() ?></span>
             <a class="timestamp" href="/@/<?= $note->author->getFullHandle() ?>/note/<?= $note->id ?>">
                 <?= // TODO: localise
@@ -49,7 +50,7 @@ if ($user != null) {
                 <a href="/@/<?= $note->inReplyTo->author->getFullHandle() ?>/note/<?= $note->inReplyTo->id ?>">
                     <span class="material-symbols-outlined inlineIcon">reply</span>
                     <?= sprintf(__('note.info.replyTo'),
-                        '<b>' . $note->inReplyTo->author->displayName) . '</b>' ?>
+                        '<b>' . htmlspecialchars($note->inReplyTo->author->displayName)) . '</b>' ?>
                 </a>
             </div>
         <?php endif; ?>
-- 
cgit v1.3