diff --git a/js/privatebin.js b/js/privatebin.js index 9443438..9db8b00 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -633,7 +633,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { let containsLinks = args[0].indexOf(' 0) may never contain HTML as they may come from untrusted parties - if (i > 0 || containsNoLinks) { + if (i > 0 || !containsLinks) { args[i] = Helper.htmlEntities(args[i]); } } diff --git a/js/test/I18n.js b/js/test/I18n.js index ba10e63..061f05b 100644 --- a/js/test/I18n.js +++ b/js/test/I18n.js @@ -57,23 +57,23 @@ describe('I18n', function () { } ); jsc.property( - 'replaces %s in strings with first given parameter, encoding params only, when a link is part of the messageID', - 'string', - '(small nearray) string', - 'string', - function (prefix, params, postfix) { - prefix = prefix.replace(/%(s|d)/g, '%%'); - params[0] = params[0].replace(/%(s|d)/g, '%%') + ''; - postfix = postfix.replace(/%(s|d)/g, '%%'); - var translation = $.PrivateBin.Helper.htmlEntities(prefix + params[0] + postfix); - params.unshift(prefix + '%s' + postfix); - var result = $.PrivateBin.I18n.translate.apply(this, params); - $.PrivateBin.I18n.reset(); - var alias = $.PrivateBin.I18n._.apply(this, params); - $.PrivateBin.I18n.reset(); - return translation === result && translation === alias; - } - ); + 'replaces %s in strings with first given parameter, encoding params only, when a link is part of the messageID', + 'string', + '(small nearray) string', + 'string', + function (prefix, params, postfix) { + prefix = prefix.replace(/%(s|d)/g, '%%'); + params[0] = params[0].replace(/%(s|d)/g, '%%') + ''; + postfix = postfix.replace(/%(s|d)/g, '%%'); + var translation = $.PrivateBin.Helper.htmlEntities(prefix) + params[0] + $.PrivateBin.Helper.htmlEntities(postfix); + params.unshift(prefix + '%s' + postfix); + var result = $.PrivateBin.I18n.translate.apply(this, params); + $.PrivateBin.I18n.reset(); + var alias = $.PrivateBin.I18n._.apply(this, params); + $.PrivateBin.I18n.reset(); + return translation === result && translation === alias; + } + ); }); describe('getPluralForm', function () { diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 26c3d8e..90607b8 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -72,7 +72,7 @@ endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 0d0f407..1cae5e5 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -50,7 +50,7 @@ endif; ?> - +