free
/
searx
Watch 1
Star 0
Fork 0
Code Issues 0 Pull Requests 0 Releases 11 Wiki Activity
Browse Source

[fix] proper escaping of the search query in templates

Adam Tauber 8 years ago
parent
7986d4cf41
commit
28f12ef5a0
4 changed files with 20 additions and 20 deletions
Split View Show Diff Stats
  1. 5
    5
      searx/templates/courgette/results.html
  2. 5
    5
      searx/templates/legacy/results.html
  3. 7
    7
      searx/templates/oscar/results.html
  4. 3
    3
      searx/templates/pix-art/results.html

+ 5
- 5
searx/templates/courgette/results.html View File 

@@ -1,6 +1,6 @@
1 1 
 {% extends "courgette/base.html" %}
2 
-{% block title %}{{ q }} - {% endblock %}
3 
-{% block meta %}<link rel="alternate" type="application/rss+xml" title="Searx search: {{ q }}" href="{{ url_for('index') }}?q={{ q|urlencode }}&amp;format=rss&amp;{% for category in selected_categories %}category_{{ category }}=1&amp;{% endfor %}pageno={{ pageno }}">{% endblock %}
2 
+{% block title %}{{ q|e }} - {% endblock %}
3 
+{% block meta %}<link rel="alternate" type="application/rss+xml" title="Searx search: {{ q|e }}" href="{{ url_for('index') }}?q={{ q|urlencode }}&amp;format=rss&amp;{% for category in selected_categories %}category_{{ category }}=1&amp;{% endfor %}pageno={{ pageno }}">{% endblock %}
4 4 
 {% block content %}
5 5 
 <div class="right"><a href="{{ url_for('preferences') }}" id="preferences"><span>{{ _('preferences') }}</span></a></div>
6 6 
 <div class="small search center">
 
@@ -17,7 +17,7 @@
17 17 
             {% for output_type in ('csv', 'json', 'rss') %}
18 18 
             <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}">
19 19 
                 <div class="left">
20 
-                    <input type="hidden" name="q" value="{{ q }}" />
20 
+                    <input type="hidden" name="q" value="{{ q|e }}" />
21 21 
                     <input type="hidden" name="format" value="{{ output_type }}" />
22 22 
                     {% for category in selected_categories %}
23 23 
                     <input type="hidden" name="category_{{ category }}" value="1"/>
 
@@ -62,7 +62,7 @@
62 62 
         {% if pageno > 1 %}
63 63 
             <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}">
64 64 
                 <div class="left">
65 
-                    <input type="hidden" name="q" value="{{ q }}" />
65 
+                    <input type="hidden" name="q" value="{{ q|e }}" />
66 66 
                     {% for category in selected_categories %}
67 67 
                     <input type="hidden" name="category_{{ category }}" value="1"/>
68 68 
                     {% endfor %}
 
@@ -76,7 +76,7 @@
76 76 
                 {% for category in selected_categories %}
77 77 
                 <input type="hidden" name="category_{{ category }}" value="1"/>
78 78 
                 {% endfor %}
79 
-                <input type="hidden" name="q" value="{{ q }}" />
79 
+                <input type="hidden" name="q" value="{{ q|e }}" />
80 80 
                 <input type="hidden" name="pageno" value="{{ pageno+1 }}" />
81 81 
                 <input type="submit" value="{{ _('next page') }} >>" />
82 82 
             </div>

+ 5
- 5
searx/templates/legacy/results.html View File 

@@ -1,6 +1,6 @@
1 1 
 {% extends "legacy/base.html" %}
2 
-{% block title %}{{ q }} - {% endblock %}
3 
-{% block meta %}<link rel="alternate" type="application/rss+xml" title="Searx search: {{ q }}" href="{{ url_for('index') }}?q={{ q|urlencode }}&amp;format=rss&amp;{% for category in selected_categories %}category_{{ category }}=1&amp;{% endfor %}pageno={{ pageno }}">{% endblock %}
2 
+{% block title %}{{ q|e }} - {% endblock %}
3 
+{% block meta %}<link rel="alternate" type="application/rss+xml" title="Searx search: {{ q|e }}" href="{{ url_for('index') }}?q={{ q|urlencode }}&amp;format=rss&amp;{% for category in selected_categories %}category_{{ category }}=1&amp;{% endfor %}pageno={{ pageno }}">{% endblock %}
4 4 
 {% block content %}
5 5 
 <div class="preferences_container right"><a href="{{ url_for('preferences') }}" id="preferences"><span>preferences</span></a></div>
6 6 
 <div class="small search center">
 
@@ -18,7 +18,7 @@
18 18 
         {% for output_type in ('csv', 'json', 'rss') %}
19 19 
         <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}">
20 20 
             <div class="left">
21 
-            <input type="hidden" name="q" value="{{ q }}" />
21 
+            <input type="hidden" name="q" value="{{ q|e }}" />
22 22 
             <input type="hidden" name="format" value="{{ output_type }}" />
23 23 
             {% for category in selected_categories %}
24 24 
             <input type="hidden" name="category_{{ category }}" value="1"/>
 
@@ -73,7 +73,7 @@
73 73 
         {% if pageno > 1 %}
74 74 
             <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}">
75 75 
                 <div class="{% if rtl %}right{% else %}left{% endif %}">
76 
-                <input type="hidden" name="q" value="{{ q }}" />
76 
+                <input type="hidden" name="q" value="{{ q|e }}" />
77 77 
                 {% for category in selected_categories %}
78 78 
                 <input type="hidden" name="category_{{ category }}" value="1"/>
79 79 
                 {% endfor %}
 
@@ -87,7 +87,7 @@
87 87 
                 {% for category in selected_categories %}
88 88 
                 <input type="hidden" name="category_{{ category }}" value="1"/>
89 89 
                 {% endfor %}
90 
-                <input type="hidden" name="q" value="{{ q }}" />
90 
+                <input type="hidden" name="q" value="{{ q|e }}" />
91 91 
                 <input type="hidden" name="pageno" value="{{ pageno+1 }}" />
92 92 
                 <input type="submit" value="{{ _('next page') }} >>" />
93 93 
             </div>

+ 7
- 7
searx/templates/oscar/results.html View File 

@@ -1,6 +1,6 @@
1 1 
 {% extends "oscar/base.html" %}
2 
-{% block title %}{{ q }} - {% endblock %}
3 
-{% block meta %}<link rel="alternate" type="application/rss+xml" title="Searx search: {{ q }}" href="{{ url_for('index') }}?q={{ q|urlencode }}&amp;format=rss&amp;{% for category in selected_categories %}category_{{ category }}=1&amp;{% endfor %}pageno={{ pageno }}&amp;time_range={{ time_range }}">{% endblock %}
2 
+{% block title %}{{ q|e }} - {% endblock %}
3 
+{% block meta %}<link rel="alternate" type="application/rss+xml" title="Searx search: {{ q|e }}" href="{{ url_for('index') }}?q={{ q|urlencode }}&amp;format=rss&amp;{% for category in selected_categories %}category_{{ category }}=1&amp;{% endfor %}pageno={{ pageno }}&amp;time_range={{ time_range }}">{% endblock %}
4 4 
 {% block content %}
5 5 
     <div class="row">
6 6 
         <div class="col-sm-8" id="main_results">

@@ -37,9 +37,9 @@
37 37 
             <div id="pagination">
38 38 
                 <div class="pull-left">
39 39 
                     <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}" class="pull-left">
40 
-                        <input type="hidden" name="q" value="{{ q }}" />
40 
+                        <input type="hidden" name="q" value="{{ q|e }}" />
41 41 
                         {% for category in selected_categories %}<input type="hidden" name="category_{{ category }}" value="1"/>{% endfor %}
42 
-                        <input type="hidden" name="q" value="{{ q }}" />
42 
+                        <input type="hidden" name="q" value="{{ q|e }}" />
43 43 
                         <input type="hidden" name="pageno" value="{{ pageno+1 }}" />
44 44 
                         <input type="hidden" name="time_range" value="{{ time_range }}" />
45 45 
                         <button type="submit" class="btn btn-default"><span class="glyphicon glyphicon-backward"></span> {{ _('next page') }}</button>

@@ -59,7 +59,7 @@
59 59 
             <div id="pagination">
60 60 
                 <div class="pull-left">
61 61 
                     <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}" class="pull-left">
62 
-                        <input type="hidden" name="q" value="{{ q }}" />
62 
+                        <input type="hidden" name="q" value="{{ q|e }}" />
63 63 
                         {% for category in selected_categories %}<input type="hidden" name="category_{{ category }}" value="1"/>{% endfor %}
64 64 
                         <input type="hidden" name="pageno" value="{{ pageno-1 }}" />
65 65 
                         <input type="hidden" name="time_range" value="{{ time_range }}" />

@@ -69,7 +69,7 @@
69 69 
                 <div class="pull-right">
70 70 
                     <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}"  class="pull-left">
71 71 
                         {% for category in selected_categories %}<input type="hidden" name="category_{{ category }}" value="1"/>{% endfor %}
72 
-                        <input type="hidden" name="q" value="{{ q }}" />
72 
+                        <input type="hidden" name="q" value="{{ q|e }}" />
73 73 
                         <input type="hidden" name="pageno" value="{{ pageno+1 }}" />
74 74 
                         <input type="hidden" name="time_range" value="{{ time_range }}" />
75 75 
                         <button type="submit" class="btn btn-default"><span class="glyphicon glyphicon-forward"></span> {{ _('next page') }}</button>

@@ -130,7 +130,7 @@
130 130 
                     <div class="clearfix"></div>
131 131 
                     {% for output_type in ('csv', 'json', 'rss') %}
132 132 
                     <form method="{{ method or 'POST' }}" action="{{ url_for('index') }}" class="form-inline pull-{% if rtl %}right{% else %}left{% endif %} result_download">
133 
-                        <input type="hidden" name="q" value="{{ q }}">
133 
+                        <input type="hidden" name="q" value="{{ q|e }}">
134 134 
                         <input type="hidden" name="format" value="{{ output_type }}">
135 135 
                         {% for category in selected_categories %}<input type="hidden" name="category_{{ category }}" value="1">{% endfor %}
136 136 
                         <input type="hidden" name="pageno" value="{{ pageno }}">

+ 3
- 3
searx/templates/pix-art/results.html View File 

@@ -5,7 +5,7 @@
5 5 
     {% endfor %}
6 6 
 {% else %}
7 7 
 {% extends "pix-art/base.html" %}
8 
-{% block title %}{{ q }} - {% endblock %}
8 
+{% block title %}{{ q|e }} - {% endblock %}
9 9 
 {% block meta %}{% endblock %}
10 10 
 {% block content %}
11 11 
 <div id="logo"><a href="./"><img src="{{ url_for('static', filename='img/searx-pixel-small.png') }}" alt="searx Logo"/></a></div>
 
@@ -25,8 +25,8 @@
25 25 
     </span>
26 26 
     <div id="pagination">
27 27 
         <br />
28 
-        <input type="button" onclick="load_more('{{ q }}', {{ pageno+1 }})" id="load_more" value="{{ _('Load more...') }}" />
28 
+        <input type="button" onclick="load_more('{{ q|e }}', {{ pageno+1 }})" id="load_more" value="{{ _('Load more...') }}" />
29 29 
     </div>
30 30 
 </div>
31 31 
 {% endblock %}
32 
-{% endif %}
32 
+{% endif %}