serv/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-01-06 02:48:48 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

browse: Sanitize file names and links in default template

Browse source 
Thanks to Kevin Froman (@beardog108) for the responsible heads up.
This commit is contained in:
Matthew Holt 2017-01-23 22:37:46 -07:00
parent bbee961415
commit 62fea30e87
No known key found for this signature in database
GPG key ID: 2A349DD577D586A5
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
caddyhttp/browse/setup.go
View file

@ -101,7 +101,7 @@ func browseParse(c *caddy.Controller) ([]Config, error) {
const defaultTemplate = `<!DOCTYPE html> const defaultTemplate = `<!DOCTYPE html>
<html> <html>
<head> <head>
<title>{{.Name}}</title> <title>{{html .Name}}</title>
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<style> <style>
@ -323,7 +323,7 @@ footer {
<header> <header>
<h1> <h1>
{{range $url, $name := .BreadcrumbMap}}<a href="{{$url}}">{{$name}}</a>{{if ne $url "/"}}/{{end}}{{end}} {{range $url, $name := .BreadcrumbMap}}<a href="{{html $url}}">{{html $name}}</a>{{if ne $url "/"}}/{{end}}{{end}}
</h1> </h1>
</header> </header>
<main> <main>
@ -385,13 +385,13 @@ footer {
{{- range .Items}} {{- range .Items}}
<tr class="file"> <tr class="file">
<td> <td>
<a href="{{.URL}}"> <a href="{{html .URL}}">
{{- if .IsDir}} {{- if .IsDir}}
<svg width="1.5em" height="1em" version="1.1" viewBox="0 0 35.678803 28.527945"><use xlink:href="#folder"></use></svg> <svg width="1.5em" height="1em" version="1.1" viewBox="0 0 35.678803 28.527945"><use xlink:href="#folder"></use></svg>
{{- else}} {{- else}}
<svg width="1.5em" height="1em" version="1.1" viewBox="0 0 26.604381 29.144726"><use xlink:href="#file"></use></svg> <svg width="1.5em" height="1em" version="1.1" viewBox="0 0 26.604381 29.144726"><use xlink:href="#file"></use></svg>
{{- end}} {{- end}}
<span class="name">{{.Name}}</span> <span class="name">{{html .Name}}</span>
</a> </a>
</td> </td>
{{- if .IsDir}} {{- if .IsDir}}
@ -407,7 +407,7 @@ footer {
</div> </div>
</main> </main>
<footer> <footer>
Served with <a rel="noopener noreferrer" href="https://caddyserver.com">Caddy</a>. Served with <a rel="noopener noreferrer" href="https://caddyserver.com">Caddy</a>
</footer> </footer>
<script> <script>
var filterEl = document.getElementById('filter'); var filterEl = document.getElementById('filter');