Fix template to escape rendered strings

This commit is contained in:
Brian Jacobel
2017-03-13 17:50:16 -04:00
committed by GitHub
parent b3674b34ab
commit 85fc5871d6

View File

@@ -1,13 +1,13 @@
<% if (!readOnly) { %>
<ul class="<%= contentType %>-actions-list">
<ul class="<%- contentType %>-actions-list">
<% _.each(primaryActions, function(action) { print(_.template($('#forum-action-' + action).html())({})) }) %>
<li class="actions-item is-visible">
<div class="more-wrapper">
<button class="btn-link action-button action-more" aria-label="<%- gettext('More') %>" aria-haspopup="true" aria-controls="action-menu-<%= contentType %>-<%= contentId %>">
<button class="btn-link action-button action-more" aria-label="<%- gettext('More') %>" aria-haspopup="true" aria-controls="action-menu-<%- contentType %>-<%- contentId %>">
<span class="action-label"><%- gettext('More') %></span>
<span class="action-icon"><span class="icon fa fa-ellipsis-h" aria-hidden="true"></span></span>
</button>
<div class="actions-dropdown" id="action-menu-<%= contentType %>-<%= contentId %>" aria-expanded="false">
<div class="actions-dropdown" id="action-menu-<%- contentType %>-<%- contentId %>" aria-expanded="false">
<ul class="actions-dropdown-list">
<% _.each(secondaryActions, function(action) { print(_.template($('#forum-action-' + action).html())({})) }) %>
</ul>