warden/rlgallery-misc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Escape the player's name when printing it into HTML.

Browse source 
Non-alphanumeric characters in names may eventually be possible.
This commit is contained in:
John "Elwin" Edwards 2014-03-24 16:01:28 -07:00
parent 3d7abba670
commit d67561aa42
3 changed files with 20 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

3
web/scoring/players/index.cgi
View file

@ -2,6 +2,7 @@
import os
import sys
import html
import rlgall
playerdir = "/var/www/lighttpd/scoring/players/"
@ -26,7 +27,7 @@ if not namelist:
else:
sys.stdout.write("<ul>\n")
for name in namelist:
sys.stdout.write(linkstr.format(name))
sys.stdout.write(linkstr.format(html.escape(name)))
sys.stdout.write("</ul>\n")
sys.stdout.write(rlgall.pend)