Fix escaping for login page

5 years ago · fcf377d26b
parent 3be1c9261f
commit fcf377d26b
1 changed files with 2 additions and 2 deletions
--- a/src/invidious/views/login.ecr
+++ b/src/invidious/views/login.ecr
@ -32,7 +32,7 @@
                        <% end %>

                        <% if password %>
-                            <input name="password" type="hidden" value="<%= password %>">
+                            <input name="password" type="hidden" value="<%= HTML.escape(password) %>">
                        <% else %>
                            <label for="password"><%= translate(locale, "Password") %> :</label>
                            <input required class="pure-input-1" name="password" type="password" placeholder="<%= translate(locale, "Password") %>">
@ -95,7 +95,7 @@
                        <% end %>

                        <% if password %>
-                            <input name="password" type="hidden" value="<%= password %>">
+                            <input name="password" type="hidden" value="<%= HTML.escape(password) %>">
                        <% else %>
                            <label for="password"><%= translate(locale, "Password") %> :</label>
                            <input required class="pure-input-1" name="password" type="password" placeholder="<%= translate(locale, "Password") %>">