Escape title name

7 years ago · 8b2d2044b2
parent 496a8bf67b
commit 8b2d2044b2
2 changed files with 2 additions and 2 deletions
--- a/src/views/player/audio.ecr
+++ b/src/views/player/audio.ecr
@ -1,4 +1,4 @@
-<audio poster="<%= thumbnail %>" title="<%= video.title%>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
+<audio poster="<%= thumbnail %>" title="<%= HTML.escape(video.title) %>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
    <% adaptive_fmts.each do |fmt| %>
        <% if fmt["type"].starts_with?("audio") %>
            <source src="<%= fmt["url"] %>" type='<%= fmt["type"] %>'>
--- a/src/views/player/video.ecr
+++ b/src/views/player/video.ecr
@ -1,4 +1,4 @@
-<video poster="<%= thumbnail %>" title="<%= video.title%>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
+<video poster="<%= thumbnail %>" title="<%= HTML.escape(video.title) %>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
    <% fmt_stream.each do |fmt| %>
        <source src="<%= fmt["url"]? %>" type='<%= fmt["type"]? %>'>
    <% end %>