diff options
author | Rodolfo Carvalho <rhcarvalho@gmail.com> | 2019-04-22 15:26:36 +0100 |
---|---|---|
committer | Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com> | 2019-05-17 16:00:54 +0200 |
commit | e22b3f54c3d8ce6567c21c63beab0b03cf7983ea (patch) | |
tree | 850d61fce01aa770a5abec671a4a33472a72b74a /.github/calibre | |
parent | 71b8d8b6a4127acacda8ada08cd61d7bfb18e962 (diff) |
tpl: Fix internal templates usage of safeHTMLAttr
The `safeHTMLAttr` function operates on a full attribute definition, not
just within the attribute value.
Docs: https://gohugo.io/functions/safehtmlattr/
For `opengraph.html`, run the whole `content` HTML attribute through
`safeHTMLAttr`. That will preserve `+` signs in formatted dates.
For `vimeo_simple.html`, `safeHTMLAttr` was in the context of an
attribute value, thus having no effect. In this case we could replace it
with `safeURL`, but since the code is coming from an API it is safer to
just let Go's template engine sanitize the value as it already does with
`provider_url`.
Fixes #5236 (no need to change Go upstream)
Related to #5246
Diffstat (limited to '.github/calibre')
0 files changed, 0 insertions, 0 deletions