Change <input value="..."> encoding to HTML.escape

2025-12-27 01:51:15 +00:00 · 2021-10-11 20:35:07 +00:00
parent 0ca333715b
commit cb0f7bf6b0
13 changed files with 17 additions and 17 deletions
--- a/src/invidious/views/create_playlist.ecr
+++ b/src/invidious/views/create_playlist.ecr
@@ -30,7 +30,7 @@
                        </button>
                    </div>

-                    <input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(csrf_token) %>">
+                    <input type="hidden" name="csrf_token" value="<%= HTML.escape(csrf_token) %>">
                </fieldset>
            </form>
        </div>