Skip to content

Commit ab22327

Browse files
wxiaoguangwxiaoguang
committed
fix
1 parent 1ef8777 commit ab22327

File tree

21 files changed

+77
-56
lines changed

21 files changed

+77
-56
lines changed

‎modules/templates/helper.go

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"html"
1010
"html/template"
1111
"net/url"
12+
"slices"
1213
"strings"
1314
"time"
1415

@@ -34,7 +35,7 @@ func NewFuncMap() template.FuncMap {
3435
// html/template related functions
3536
"dict": dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
3637
"Eval": Eval,
37-
"Safe": Safe,
38+
"HTML": HTMLFormat,
3839
"Escape": Escape,
3940
"QueryEscape": url.QueryEscape,
4041
"JSEscape": JSEscapeSafe,
@@ -177,13 +178,33 @@ func NewFuncMap() template.FuncMap {
177178
}
178179
}
179180

180-
// Safe render raw as HTML
181-
func Safe(s any) template.HTML {
181+
func htmlFormat(s string, rawArgs ...any) template.HTML {
182+
if len(rawArgs) == 0 {
183+
return template.HTML(s)
184+
}
185+
args := slices.Clone(rawArgs)
186+
for i, v := range args {
187+
switch v := v.(type) {
188+
case nil, bool, int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64, template.HTML:
189+
// for most basic types (including template.HTML which is safe), just do nothing and use it
190+
case string:
191+
args[i] = template.HTMLEscapeString(v)
192+
case fmt.Stringer:
193+
args[i] = template.HTMLEscapeString(v.String())
194+
default:
195+
args[i] = template.HTMLEscapeString(fmt.Sprint(v))
196+
}
197+
}
198+
return template.HTML(fmt.Sprintf(s, args...))
199+
}
200+
201+
// HTMLFormat render raw as HTML
202+
func HTMLFormat(s any, args ...any) template.HTML {
182203
switch v := s.(type) {
183204
case string:
184-
return template.HTML(v)
205+
return htmlFormat(v, args...)
185206
case template.HTML:
186-
return v
207+
return htmlFormat(string(v), args...)
187208
}
188209
panic(fmt.Sprintf("unexpected type %T", s))
189210
}

‎templates/admin/packages/list.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "packages.settings.delete"}}
8989
</div>
9090
<div class="content">
91-
{{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|Safe) (`<span class="dataVersion"></span>`|Safe)}}
91+
{{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|HTML) (`<span class="dataVersion"></span>`|HTML)}}
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/admin/repo/list.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
</div>
102102
<div class="content">
103103
<p>{{ctx.Locale.Tr "repo.settings.delete_desc"}}</p>
104-
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|Safe)}}<br>
104+
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|HTML)}}<br>
105105
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}<br>
106106
</div>
107107
{{template "base/modal_actions_confirm" .}}

‎templates/admin/stacktrace.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
{{ctx.Locale.Tr "admin.monitor.process.cancel"}}
4040
</div>
4141
<div class="content">
42-
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|Safe)}}</p>
42+
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|HTML)}}</p>
4343
<p>{{ctx.Locale.Tr "admin.monitor.process.cancel_desc"}}</p>
4444
</div>
4545
{{template "base/modal_actions_confirm" .}}

‎templates/mail/issue/assigned.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@
88
<title>{{.Subject}}</title>
99
</head>
1010

11-
{{$repo_url := printf "<a href='%s'>%s</a>" (Escape .Issue.Repo.HTMLURL) (Escape .Issue.Repo.FullName)}}
12-
{{$link := printf "<a href='%s'>#%d</a>" (Escape .Link) .Issue.Index}}
11+
{{$repo_url := HTML "<a href='%s'>%s</a>" .Issue.Repo.HTMLURL Escape .Issue.Repo.FullName}}
12+
{{$link := HTML "<a href='%s'>#%d</a>" .Link .Issue.Index}}
1313
<body>
1414
<p>
1515
{{if .IsPull}}
16-
{{.locale.Tr "mail.issue_assigned.pull" .Doer.Name ($link|Safe) ($repo_url|Safe)}}
16+
{{.locale.Tr "mail.issue_assigned.pull" .Doer.Name $link $repo_url}}
1717
{{else}}
18-
{{.locale.Tr "mail.issue_assigned.issue" .Doer.Name ($link|Safe) ($repo_url|Safe)}}
18+
{{.locale.Tr "mail.issue_assigned.issue" .Doer.Name $link $repo_url}}
1919
{{end}}
2020
</p>
2121
<div class="footer">

‎templates/mail/issue/default.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@
2222
{{if .Comment.IsForcePush}}
2323
{{$oldCommitUrl := printf "%s/commit/%s" .Comment.Issue.PullRequest.BaseRepo.HTMLURL .Comment.OldCommit}}
2424
{{$oldShortSha := ShortSha .Comment.OldCommit}}
25-
{{$oldCommitLink := printf "<a href='%[1]s'><b>%[2]s</b></a>" (Escape $oldCommitUrl) (Escape $oldShortSha)}}
25+
{{$oldCommitLink := HTML "<a href='%[1]s'><b>%[2]s</b></a>" $oldCommitUrl $oldShortSha}}
2626

2727
{{$newCommitUrl := printf "%s/commit/%s" .Comment.Issue.PullRequest.BaseRepo.HTMLURL .Comment.NewCommit}}
2828
{{$newShortSha := ShortSha .Comment.NewCommit}}
29-
{{$newCommitLink := printf "<a href='%[1]s'><b>%[2]s</b></a>" (Escape $newCommitUrl) (Escape $newShortSha)}}
29+
{{$newCommitLink := HTML "<a href='%[1]s'><b>%[2]s</b></a>" $newCommitUrl $newShortSha}}
3030

31-
{{.locale.Tr "mail.issue.action.force_push" .Doer.Name .Comment.Issue.PullRequest.HeadBranch ($oldCommitLink|Safe) ($newCommitLink|Safe)}}
31+
{{.locale.Tr "mail.issue.action.force_push" .Doer.Name .Comment.Issue.PullRequest.HeadBranch $oldCommitLink $newCommitLink}}
3232
{{else}}
3333
{{.locale.TrN (len .Comment.Commits) "mail.issue.action.push_1" "mail.issue.action.push_n" .Doer.Name .Comment.Issue.PullRequest.HeadBranch (len .Comment.Commits)}}
3434
{{end}}
@@ -65,7 +65,7 @@
6565
{{$.locale.Tr "mail.issue.in_tree_path" .TreePath}}
6666
<div class="review">
6767
<pre>{{.Patch}}</pre>
68-
<div>{{.RenderedContent | Safe}}</div>
68+
<div>{{.RenderedContent | HTML}}</div>
6969
</div>
7070
{{end -}}
7171
{{if eq .ActionName "push"}}

‎templates/mail/notify/repo_transfer.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
<title>{{.Subject}}</title>
66
</head>
77

8-
{{$url := printf "<a href='%[1]s'>%[2]s</a>" (Escape .Link) (Escape .Repo)}}
8+
{{$url := HTML "<a href='%[1]s'>%[2]s</a>" .Link .Repo)}}
99
<body>
1010
<p>{{.Subject}}.
11-
{{.locale.Tr "mail.repo.transfer.body" ($url|Safe)}}
11+
{{.locale.Tr "mail.repo.transfer.body" $url}}
1212
</p>
1313
<p>
1414
---

‎templates/mail/release.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@
1111

1212
</head>
1313

14-
{{$release_url := printf "<a href='%s'>%s</a>" (.Release.HTMLURL | Escape) (.Release.TagName | Escape)}}
15-
{{$repo_url := printf "<a href='%s'>%s</a>" (.Release.Repo.HTMLURL | Escape) (.Release.Repo.FullName | Escape)}}
14+
{{$release_url := HTML "<a href='%s'>%s</a>" .Release.HTMLURL .Release.TagName}}
15+
{{$repo_url := HTML "<a href='%s'>%s</a>" .Release.Repo.HTMLURL .Release.Repo.FullName}}
1616
<body>
1717
<p>
18-
{{.locale.Tr "mail.release.new.text" .Release.Publisher.Name ($release_url|Safe) ($repo_url|Safe)}}
18+
{{.locale.Tr "mail.release.new.text" .Release.Publisher.Name $release_url $repo_url}}
1919
</p>
2020
<h4>{{.locale.Tr "mail.release.title" .Release.Title}}</h4>
2121
<p>

‎templates/org/member/members.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@
7373
{{ctx.Locale.Tr "org.members.leave"}}
7474
</div>
7575
<div class="content">
76-
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
76+
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|HTML)}}</p>
7777
</div>
7878
{{template "base/modal_actions_confirm" .}}
7979
</div>
@@ -82,7 +82,7 @@
8282
{{ctx.Locale.Tr "org.members.remove"}}
8383
</div>
8484
<div class="content">
85-
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
85+
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|HTML) (`<span class="dataOrganizationName"></span>`|HTML)}}</p>
8686
</div>
8787
{{template "base/modal_actions_confirm" .}}
8888
</div>

‎templates/org/team/members.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
{{ctx.Locale.Tr "org.members.remove"}}
8282
</div>
8383
<div class="content">
84-
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataTeamName"></span>`|Safe)}}</p>
84+
<p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|HTML) (`<span class="dataTeamName"></span>`|HTML)}}</p>
8585
</div>
8686
{{template "base/modal_actions_confirm" .}}
8787
</div>

‎templates/org/team/sidebar.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{ctx.Locale.Tr "org.teams.leave"}}
8989
</div>
9090
<div class="content">
91-
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
91+
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|HTML)}}</p>
9292
</div>
9393
{{template "base/modal_actions_confirm" .}}
9494
</div>

‎templates/org/team/teams.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
{{ctx.Locale.Tr "org.teams.leave"}}
5050
</div>
5151
<div class="content">
52-
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
52+
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|HTML)}}</p>
5353
</div>
5454
{{template "base/modal_actions_confirm" .}}
5555
</div>

‎templates/repo/commit_page.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
{{.CsrfTokenHtml}}
8989
<div class="field">
9090
<label>
91-
{{ctx.Locale.Tr "repo.branch.new_branch_from" (`<span class="text" id="modal-create-branch-from-span"></span>`|Safe)}}
91+
{{ctx.Locale.Tr "repo.branch.new_branch_from" (`<span class="text" id="modal-create-branch-from-span"></span>`|HTML)}}
9292
</label>
9393
</div>
9494
<div class="required field">
@@ -113,7 +113,7 @@
113113
<input type="hidden" name="create_tag" value="true">
114114
<div class="field">
115115
<label>
116-
{{ctx.Locale.Tr "repo.tag.create_tag_from" (`<span class="text" id="modal-create-tag-from-span"></span>`|Safe)}}
116+
{{ctx.Locale.Tr "repo.tag.create_tag_from" (`<span class="text" id="modal-create-tag-from-span"></span>`|HTML)}}
117117
</label>
118118
</div>
119119
<div class="required field">

‎templates/repo/editor/cherry_pick.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@
1111
<div class="repo-editor-header">
1212
<div class="ui breadcrumb field {{if .Err_TreePath}}error{{end}}">
1313
{{$shaurl := printf "%s/commit/%s" $.RepoLink (PathEscape .SHA)}}
14-
{{$shalink := printf `<a class="ui primary sha label" href="%s">%s</a>` (Escape $shaurl) (ShortSha .SHA)}}
14+
{{$shalink := HTML `<a class="ui primary sha label" href="%s">%s</a>` $shaurl (ShortSha .SHA)}}
1515
{{if eq .CherryPickType "revert"}}
16-
{{ctx.Locale.Tr "repo.editor.revert" ($shalink|Safe)}}
16+
{{ctx.Locale.Tr "repo.editor.revert" $shalink}}
1717
{{else}}
18-
{{ctx.Locale.Tr "repo.editor.cherry_pick" ($shalink|Safe)}}
18+
{{ctx.Locale.Tr "repo.editor.cherry_pick" $shalink}}
1919
{{end}}
2020
<a class="section" href="{{$.RepoLink}}">{{.Repository.FullName}}</a>
2121
<div class="breadcrumb-divider">:</div>

‎templates/repo/issue/view_content/comments.tmpl

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@
112112
{{template "shared/user/authorlink" .Poster}}
113113
{{$link := printf "%s/commit/%s" $.Repository.Link ($.Issue.PullRequest.MergedCommitID|PathEscape)}}
114114
{{if eq $.Issue.PullRequest.Status 3}}
115-
{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
115+
{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (HTML `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` $link (ShortSha $.Issue.PullRequest.MergedCommitID)) (HTML "<b>%[1]s</b>" $.BaseTarget) $createdStr}}
116116
{{else}}
117-
{{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
117+
{{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (HTML `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` $link (ShortSha $.Issue.PullRequest.MergedCommitID)) (HTML "<b>%[1]s</b>" $.BaseTarget) $createdStr}}
118118
{{end}}
119119
</span>
120120
</div>
@@ -595,19 +595,19 @@
595595
{{$oldProjectDisplayHtml := "Unknown Project"}}
596596
{{if .OldProject}}
597597
{{$trKey := printf "projects.type-%d.display_name" .OldProject.Type}}
598-
{{$oldProjectDisplayHtml = printf `<span data-tooltip-content="%s">%s</span>` (ctx.Locale.Tr $trKey | Escape) (.OldProject.Title | Escape)}}
598+
{{$oldProjectDisplayHtml = HTML `<span data-tooltip-content="%s">%s</span>` (ctx.Locale.Tr $trKey) .OldProject.Title}}
599599
{{end}}
600600
{{$newProjectDisplayHtml := "Unknown Project"}}
601601
{{if .Project}}
602602
{{$trKey := printf "projects.type-%d.display_name" .Project.Type}}
603-
{{$newProjectDisplayHtml = printf `<span data-tooltip-content="%s">%s</span>` (ctx.Locale.Tr $trKey | Escape) (.Project.Title | Escape)}}
603+
{{$newProjectDisplayHtml = HTML `<span data-tooltip-content="%s">%s</span>` (ctx.Locale.Tr $trKey) .Project.Title}}
604604
{{end}}
605605
{{if and (gt .OldProjectID 0) (gt .ProjectID 0)}}
606-
{{ctx.Locale.Tr "repo.issues.change_project_at" ($oldProjectDisplayHtml|Safe) ($newProjectDisplayHtml|Safe) $createdStr}}
606+
{{ctx.Locale.Tr "repo.issues.change_project_at" $oldProjectDisplayHtml $newProjectDisplayHtml $createdStr}}
607607
{{else if gt .OldProjectID 0}}
608-
{{ctx.Locale.Tr "repo.issues.remove_project_at" ($oldProjectDisplayHtml|Safe) $createdStr}}
608+
{{ctx.Locale.Tr "repo.issues.remove_project_at" $oldProjectDisplayHtml $createdStr}}
609609
{{else if gt .ProjectID 0}}
610-
{{ctx.Locale.Tr "repo.issues.add_project_at" ($newProjectDisplayHtml|Safe) $createdStr}}
610+
{{ctx.Locale.Tr "repo.issues.add_project_at" $newProjectDisplayHtml $createdStr}}
611611
{{end}}
612612
</span>
613613
</div>

‎templates/repo/issue/view_content/pull.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
{{ctx.Locale.Tr "repo.pulls.merged_success"}}
4040
</h3>
4141
<div class="merge-section-info">
42-
{{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape) | Safe)}}
42+
{{ctx.Locale.Tr "repo.pulls.merged_info_text" (HTML "<code>%s</code>" .HeadTarget)}}
4343
</div>
4444
</div>
4545
<div class="item-section-right">

‎templates/repo/issue/view_title.tmpl

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,31 +43,31 @@
4343
{{end}}
4444
<div class="gt-ml-3">
4545
{{if .Issue.IsPull}}
46-
{{$headHref := .HeadTarget|Escape}}
46+
{{$headHref := .HeadTarget}}
4747
{{if .HeadBranchLink}}
48-
{{$headHref = printf `<a href="%s">%s</a>` (.HeadBranchLink | Escape) $headHref}}
48+
{{$headHref = HTML `<a href="%s">%s</a>` .HeadBranchLink $headHref}}
4949
{{end}}
50-
{{$headHref = printf `%s <button class="btn interact-fg" data-tooltip-content="%s" data-clipboard-text="%s">%s</button>` $headHref (ctx.Locale.Tr "copy_branch") (.HeadTarget | Escape) (svg "octicon-copy" 14)}}
51-
{{$baseHref := .BaseTarget|Escape}}
50+
{{$headHref = HTML `%s <button class="btn interact-fg" data-tooltip-content="%s" data-clipboard-text="%s">%s</button>` $headHref (ctx.Locale.Tr "copy_branch") .HeadTarget (svg "octicon-copy" 14)}}
51+
{{$baseHref := .BaseTarget}}
5252
{{if .BaseBranchLink}}
53-
{{$baseHref = printf `<a href="%s">%s</a>` (.BaseBranchLink | Escape) $baseHref}}
53+
{{$baseHref = HTML `<a href="%s">%s</a>` .BaseBranchLink $baseHref}}
5454
{{end}}
5555
{{if .Issue.PullRequest.HasMerged}}
5656
{{$mergedStr:= TimeSinceUnix .Issue.PullRequest.MergedUnix ctx.Locale}}
5757
{{if .Issue.OriginalAuthor}}
5858
{{.Issue.OriginalAuthor}}
59-
<span class="pull-desc">{{ctx.Locale.Tr "repo.pulls.merged_title_desc" .NumCommits ($headHref|Safe) ($baseHref|Safe) $mergedStr}}</span>
59+
<span class="pull-desc">{{ctx.Locale.Tr "repo.pulls.merged_title_desc" .NumCommits $headHref $baseHref $mergedStr}}</span>
6060
{{else}}
6161
<a {{if gt .Issue.PullRequest.Merger.ID 0}}href="{{.Issue.PullRequest.Merger.HomeLink}}"{{end}}>{{.Issue.PullRequest.Merger.GetDisplayName}}</a>
62-
<span class="pull-desc">{{ctx.Locale.Tr "repo.pulls.merged_title_desc" .NumCommits ($headHref|Safe) ($baseHref|Safe) $mergedStr}}</span>
62+
<span class="pull-desc">{{ctx.Locale.Tr "repo.pulls.merged_title_desc" .NumCommits $headHref $baseHref $mergedStr}}</span>
6363
{{end}}
6464
{{else}}
6565
{{if .Issue.OriginalAuthor}}
66-
<span id="pull-desc" class="pull-desc">{{.Issue.OriginalAuthor}} {{ctx.Locale.Tr "repo.pulls.title_desc" .NumCommits ($headHref|Safe) ($baseHref|Safe)}}</span>
66+
<span id="pull-desc" class="pull-desc">{{.Issue.OriginalAuthor}} {{ctx.Locale.Tr "repo.pulls.title_desc" .NumCommits $headHref $baseHref}}</span>
6767
{{else}}
6868
<span id="pull-desc" class="pull-desc">
6969
<a {{if gt .Issue.Poster.ID 0}}href="{{.Issue.Poster.HomeLink}}"{{end}}>{{.Issue.Poster.GetDisplayName}}</a>
70-
{{ctx.Locale.Tr "repo.pulls.title_desc" .NumCommits ($headHref|Safe) ($baseHref|Safe)}}
70+
{{ctx.Locale.Tr "repo.pulls.title_desc" .NumCommits $headHref $baseHref}}
7171
</span>
7272
{{end}}
7373
<span id="pull-desc-edit" class="gt-hidden flex-text-block">

‎templates/repo/settings/lfs_file.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515
{{template "repo/unicode_escape_prompt" dict "EscapeStatus" .EscapeStatus "root" $}}
1616
<div class="file-view{{if .IsMarkup}} markup {{.MarkupType}}{{else if .IsPlainText}} plain-text{{else if .IsTextFile}} code-view{{end}}">
1717
{{if .IsMarkup}}
18-
{{if .FileContent}}{{.FileContent | Safe}}{{end}}
18+
{{if .FileContent}}{{.FileContent | HTML}}{{end}}
1919
{{else if .IsPlainText}}
20-
<pre>{{if .FileContent}}{{.FileContent | Safe}}{{end}}</pre>
20+
<pre>{{if .FileContent}}{{.FileContent | HTML}}{{end}}</pre>
2121
{{else if not .IsTextFile}}
2222
<div class="view-raw">
2323
{{if .IsImageFile}}

‎templates/repo/settings/webhook/settings.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,7 @@
263263
<label for="authorization_header">{{ctx.Locale.Tr "repo.settings.authorization_header"}}</label>
264264
<input id="authorization_header" name="authorization_header" type="text" value="{{.Webhook.HeaderAuthorization}}"{{if eq .HookType "matrix"}} placeholder="Bearer $access_token" required{{end}}>
265265
{{if ne .HookType "matrix"}}{{/* Matrix doesn't make the authorization optional but it is implied by the help string, should be changed.*/}}
266-
<span class="help">{{ctx.Locale.Tr "repo.settings.authorization_header_desc" ("<code>Bearer token123456</code>, <code>Basic YWxhZGRpbjpvcGVuc2VzYW1l</code>" | Safe)}}</span>
266+
<span class="help">{{ctx.Locale.Tr "repo.settings.authorization_header_desc" ("<code>Bearer token123456</code>, <code>Basic YWxhZGRpbjpvcGVuc2VzYW1l</code>" | HTML)}}</span>
267267
{{end}}
268268
</div>
269269

‎templates/repo/wiki/view.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,13 @@
6767
<div class="wiki-content-parts">
6868
{{if .sidebarTocContent}}
6969
<div class="markup wiki-content-sidebar wiki-content-toc">
70-
{{.sidebarTocContent | Safe}}
70+
{{.sidebarTocContent | HTML}}
7171
</div>
7272
{{end}}
7373

7474
<div class="markup wiki-content-main {{if or .sidebarTocContent .sidebarPresent}}with-sidebar{{end}}">
7575
{{template "repo/unicode_escape_prompt" dict "EscapeStatus" .EscapeStatus "root" $}}
76-
{{.content | Safe}}
76+
{{.content | HTML}}
7777
</div>
7878

7979
{{if .sidebarPresent}}
@@ -82,7 +82,7 @@
8282
<a class="gt-float-right muted" href="{{.RepoLink}}/wiki/_Sidebar?action=_edit" aria-label="{{ctx.Locale.Tr "repo.wiki.edit_page_button"}}">{{svg "octicon-pencil"}}</a>
8383
{{end}}
8484
{{template "repo/unicode_escape_prompt" dict "EscapeStatus" .sidebarEscapeStatus "root" $}}
85-
{{.sidebarContent | Safe}}
85+
{{.sidebarContent | HTML}}
8686
</div>
8787
{{end}}
8888

@@ -94,7 +94,7 @@
9494
<a class="gt-float-right muted" href="{{.RepoLink}}/wiki/_Footer?action=_edit" aria-label="{{ctx.Locale.Tr "repo.wiki.edit_page_button"}}">{{svg "octicon-pencil"}}</a>
9595
{{end}}
9696
{{template "repo/unicode_escape_prompt" dict "footerEscapeStatus" .sidebarEscapeStatus "root" $}}
97-
{{.footerContent | Safe}}
97+
{{.footerContent | HTML}}
9898
</div>
9999
{{end}}
100100
</div>

‎templates/user/settings/organization.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
{{ctx.Locale.Tr "org.members.leave"}}
4848
</div>
4949
<div class="content">
50-
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
50+
<p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|HTML)}}</p>
5151
</div>
5252
{{template "base/modal_actions_confirm" .}}
5353
</div>

0 commit comments

Comments
 (0)