darkkirb/old-homepage
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

HTML INJECTIONS!!

Browse source
This commit is contained in:
Morten Delenk 2016-06-12 18:53:03 +02:00
parent 12661e9006
commit 155d905898
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
comments.py
View file

@ -21,7 +21,7 @@ try:
username=form["username"].value username=form["username"].value
message=form["message"].value message=form["message"].value
timestamp=int(time.time()) timestamp=int(time.time())
data={"name":form["title"],"markdown":message,"author":username,"date":timestamp} data={"name":cgi.escape(form["title"]),"markdown":cgi.escape(message),"author":cgi.escape(username),"date":timestamp}
storage.append("comments-%i"%aid,data) storage.append("comments-%i"%aid,data)
except KeyError: except KeyError:
pass pass