Escape item titles in search page

5 years ago · 9dc4f8a1aa
parent 0d536d11e3
commit 9dc4f8a1aa
1 changed files with 3 additions and 3 deletions
--- a/src/invidious/views/components/item.ecr
+++ b/src/invidious/views/components/item.ecr
@ -44,7 +44,7 @@
                        <% end %>
                    </div>
                <% end %>
-                <p><%= item.title %></p>
+                <p><%= HTML.escape(item.title) %></p>
            </a>
            <p>
                <b>
@ -76,7 +76,7 @@
                        <% end %>
                    </div>
                <% end %>
-                <p><a href="/watch?v=<%= item.id %>"><%= item.title %></a></p>
+                <p><a href="/watch?v=<%= item.id %>"><%= HTML.escape(item.title) %></a></p>
            </a>
            <p>
                <b>
@ -137,7 +137,7 @@
                    </div>
                </a>
            <% end %>
-            <p><a href="/watch?v=<%= item.id %>"><%= item.title %></a></p>
+            <p><a href="/watch?v=<%= item.id %>"><%= HTML.escape(item.title) %></a></p>
            <p>
                <b>
                    <a style="width:100%" href="/channel/<%= item.ucid %>"><%= item.author %></a>