templates: fix javascript escaping

This commit is contained in:
Milan
2022-01-27 21:51:50 +01:00
parent f90f71c529
commit b707cbe449
27 changed files with 105 additions and 102 deletions

View File

@@ -15,8 +15,8 @@
<script src="js/comment.js" type="text/javascript"></script>
<script src="js/page-leave-handler.js" type="text/javascript"></script>
<script>
var region='<TMPL_VAR loc.region>';
var event_id='<TMPL_VAR event_id>';
var region='<TMPL_VAR loc.region escape=js>';
var event_id='<TMPL_VAR event_id escape=js>';
var selectImageId='';
<TMPL_IF .forced_change>pageHasChangedCounter=1;</TMPL_IF>
<TMPL_IF .event_edited>
@@ -29,7 +29,7 @@
</TMPL_IF>
$(document).ready(
function(){
loadComments('<TMPL_VAR .event_id>', function(){
loadComments('<TMPL_VAR .event_id escape=js>', function(){
// initially hide comments
$('#event_<TMPL_VAR id>_comments').hide();
if ($('#comments table').length==0){
@@ -66,7 +66,7 @@
<TMPL_IF series_id>
<TMPL_IF .allow.read_series>
<button
onclick="view_series_details('<TMPL_VAR series_id>','<TMPL_VAR .studio_id>','<TMPL_VAR .project_id>')"
onclick="view_series_details('<TMPL_VAR series_id escape=js>','<TMPL_VAR .studio_id escape=js>','<TMPL_VAR .project_id escape=js>')"
style="float:left"
><TMPL_VAR .loc.button_edit_series>
</button>
@@ -160,7 +160,7 @@
<TMPL_IF .allow.read_comment>
<button id="showComment"
class="text"
onclick="showEventComments('<TMPL_VAR id>')"
onclick="showEventComments('<TMPL_VAR id escape=js>')"
><TMPL_VAR .loc.label_comments></button>
</TMPL_IF>
@@ -178,7 +178,7 @@
</div>
<div class="panel-body">
<div onclick="selectOldEventFromSeries('rerunEventId','<TMPL_VAR start_date>'); updateCheckBox($(this).find('input:radio'),true);"
<div onclick="selectOldEventFromSeries('rerunEventId','<TMPL_VAR start_date escape=js>'); updateCheckBox($(this).find('input:radio'),true);"
class="option"
>
<input type="radio" name="group" class="default">
@@ -477,7 +477,7 @@
</td>
<td>
<TMPL_IF .allow.update_event_field_image>
<button onclick="selectImage('<TMPL_VAR series_name escape=HTML>', '<TMPL_VAR image ESCAPE=url>', 'event', '<TMPL_VAR .project_id>','<TMPL_VAR .studio_id>','<TMPL_VAR series_id>','<TMPL_VAR event_id>'); return false;"
<button onclick="selectImage('<TMPL_VAR series_name escape=js>', '<TMPL_VAR image escape=js>', 'event', '<TMPL_VAR .project_id escape=js>','<TMPL_VAR .studio_id escape=js>','<TMPL_VAR series_id escape=js>','<TMPL_VAR event_id escape=js>'); return false;"
class="selectImage"
>
<img id="imagePreview" src="show-image.cgi?project_id=<TMPL_VAR project_id>&studio_id=<TMPL_VAR studio_id>&filename=<TMPL_VAR image>&type=icon">
@@ -555,13 +555,6 @@
><TMPL_VAR .loc.button_save></button>
</TMPL_IF>
</TMPL_IF>
<TMPL_IF .allow.delete_event>
<TMPL_UNLESS new_event>
<button type="submit" name="action" value="delete"
onclick="leavePage();commitForm('event_<TMPL_VAR event_id>','delete','delete event');return false;"
><TMPL_VAR .loc.button_delete></button>
</TMPL_UNLESS>
</TMPL_IF>
</div>
</TMPL_UNLESS>
@@ -571,7 +564,7 @@
<TMPL_IF .allow.read_comment>
<div id="comments" class="panel">
<button id="showComment" onclick="showEventComments('<TMPL_VAR id>')"><TMPL_VAR .loc.label_comments></button>
<button id="showComment" onclick="showEventComments('<TMPL_VAR id escape=js>')"><TMPL_VAR .loc.label_comments></button>
<div class="event" id="event_<TMPL_VAR id>_comments" style="line-height:100%;display:none;"> </div>
</div>
</TMPL_IF>