templates: fix javascript escaping

This commit is contained in:
Milan
2022-01-27 21:51:50 +01:00
parent f90f71c529
commit b707cbe449
27 changed files with 105 additions and 102 deletions

View File

@@ -1,13 +1,13 @@
<script src="js/image.js" type="text/javascript"></script>
<script type="text/javascript">
var region='<TMPL_VAR loc.region>';
var region='<TMPL_VAR loc.region escape=js>';
</script>
<h2><TMPL_VAR .loc.title></h2>
<TMPL_IF .allow.update_studio>
<div style="clear:both" class="newstudio">
<button onclick="add_studio('<TMPL_VAR name>')"><TMPL_VAR .loc.button_add_studio></button><br/>
<button onclick="add_studio('<TMPL_VAR name escape=js>')"><TMPL_VAR .loc.button_add_studio></button><br/>
<div id="edit_new" class="panel panel-body" style="clear:both;display:none">
<form method="post">
<input type="hidden" name="project_id" value="<TMPL_VAR .project_id>">
@@ -38,7 +38,7 @@
</div>
<div class="panel-body">
<TMPL_IF .allow.update_studio>
<button onclick="edit_studio('<TMPL_VAR id>')"><TMPL_VAR .loc.button_edit></button>
<button onclick="edit_studio('<TMPL_VAR id escape=js>')"><TMPL_VAR .loc.button_edit></button>
</TMPL_IF>
<TMPL_IF .allow.read_event>
@@ -76,11 +76,11 @@
<td>
<button
class="selectImage"
onclick="selectImage('<TMPL_VAR name escape=HTML>', '<TMPL_VAR image ESCAPE=url>', 'studio', '<TMPL_VAR .project_id>','<TMPL_VAR .studio_id>'); return false;"
onclick="selectImage('<TMPL_VAR name escape=javascript>', '<TMPL_VAR image escape=javascript>', 'studio', '<TMPL_VAR .project_id escape=js>','<TMPL_VAR .studio_id escape=js>'); return false;"
>
<img id="imagePreview" src="show-image.cgi?project_id=<TMPL_VAR .project_id>&studio_id=<TMPL_VAR .studio_id>&filename=<TMPL_VAR image>&type=icon">
<img id="imagePreview" src="show-image.cgi?project_id=<TMPL_VAR .project_id escape=js>&studio_id=<TMPL_VAR .studio_id escape=js>&filename=<TMPL_VAR image escape=js>&type=icon">
</button>
<input id="image_<TMPL_VAR id>" name="image" value="<TMPL_VAR image>" class="image" placeholder="<TMPL_VAR .loc.template_image>">
<input id="image_<TMPL_VAR id escape=js>" name="image" value="<TMPL_VAR image escape=js>" class="image" placeholder="<TMPL_VAR .loc.template_image escape=js>">
</td>
</tr>
<tr>
@@ -88,7 +88,7 @@
<td class="buttons">
<button type=submit name="action" value="save"><TMPL_VAR .loc.button_save></button>
<button type=submit class="text" name="action" value="delete"
onclick="commitForm('studio_<TMPL_VAR id>','delete','<TMPL_VAR .loc.button_delete>');return false;"
onclick="commitForm('studio_<TMPL_VAR id escape=js>','delete','<TMPL_VAR .loc.button_delete escape=js>');return false;"
><TMPL_VAR .loc.button_delete></button>
</td>
</tr>