templates: fix javascript escaping

This commit is contained in:
Milan
2022-01-27 21:51:50 +01:00
parent f90f71c529
commit b707cbe449
27 changed files with 105 additions and 102 deletions

View File

@@ -1,5 +1,5 @@
<script>
var region='<TMPL_VAR loc.region>';
var region='<TMPL_VAR loc.region escape=js>';
</script>
<h2><TMPL_VAR .loc.title></h2>
@@ -9,7 +9,7 @@
<!-- create a new series -->
<TMPL_IF .allow.create_series>
<div style="clear:both" class="newseries">
<button onclick="add_series('<TMPL_VAR series_name>')"><TMPL_VAR .loc.button_add_series></button>
<button onclick="add_series('<TMPL_VAR series_name escape=js>')"><TMPL_VAR .loc.button_add_series></button>
<div id="edit_new" class="editor" style="display:none;clear:both">
<form method="post" action="series.cgi">
<input type="hidden" name="project_id" value="<TMPL_VAR .project_id>">
@@ -38,7 +38,7 @@
<div id="newSeries">
<TMPL_LOOP newSeries>
<a
onclick="view_series_details('<TMPL_VAR series_id>','<TMPL_VAR .studio_id>','<TMPL_VAR .project_id>')"
onclick="view_series_details('<TMPL_VAR series_id escape=js>','<TMPL_VAR .studio_id escape=js>','<TMPL_VAR .project_id escape=js>')"
href="series.cgi?project_id=<TMPL_VAR .project_id>&studio_id=<TMPL_VAR .studio_id>&series_id=<TMPL_VAR series_id>&action=show"
>
<b><TMPL_IF has_single_events><TMPL_VAR .loc.single_events><TMPL_ELSE><TMPL_VAR series_name></TMPL_IF></b>
@@ -53,7 +53,7 @@
<div id="oldSeries" style="display:none;">
<TMPL_LOOP oldSeries>
<a onclick="view_series_details('<TMPL_VAR series_id>','<TMPL_VAR .studio_id>','<TMPL_VAR .project_id>')"
<a onclick="view_series_details('<TMPL_VAR series_id escape=js>','<TMPL_VAR .studio_id escape=js>','<TMPL_VAR .project_id escape=js>')"
href="series.cgi?project_id=<TMPL_VAR .project_id>&studio_id=<TMPL_VAR .studio_id>&series_id=<TMPL_VAR series_id>&action=show"
>
<b><TMPL_IF has_single_events><TMPL_VAR .loc.single_events><TMPL_ELSE><TMPL_VAR series_name></TMPL_IF></b>