From c1101c687da661e4489cde2a663a93f094cf2546 Mon Sep 17 00:00:00 2001
From: Aaron Parecki <aaron@parecki.com>
Date: Fri, 6 May 2016 07:59:16 +0200
Subject: [PATCH] escape html in syndication targets

---
 views/new-post.php                | 6 +++---
 views/partials/syndication-js.php | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/views/new-post.php b/views/new-post.php
index 7c4d3cf..da3927d 100644
--- a/views/new-post.php
+++ b/views/new-post.php
@@ -44,9 +44,9 @@
               echo '<ul>';
               foreach($this->syndication_targets as $syn) {
                 echo '<li>'
-                 . '<button data-syndicate-to="'.(isset($syn['uid']) ? $syn['uid'] : $syn['target']).'" class="btn btn-default btn-block">'
-                   . ($syn['favicon'] ? '<img src="'.$syn['favicon'].'" width="16" height="16"> ' : '')
-                   . $syn['target']
+                 . '<button data-syndicate-to="'.(isset($syn['uid']) ? htmlspecialchars($syn['uid']) : htmlspecialchars($syn['target'])).'" class="btn btn-default btn-block">'
+                   . ($syn['favicon'] ? '<img src="'.htmlspecialchars($syn['favicon']).'" width="16" height="16"> ' : '')
+                   . htmlspecialchars($syn['target'])
                  . '</button>'
                . '</li>';
               }
diff --git a/views/partials/syndication-js.php b/views/partials/syndication-js.php
index 088cb43..6267327 100644
--- a/views/partials/syndication-js.php
+++ b/views/partials/syndication-js.php
@@ -7,7 +7,7 @@ function reload_syndications() {
         var target = data.targets[i].target;
         var uid = data.targets[i].uid;
         var favicon = data.targets[i].favicon;
-        $("#syndication-container ul").append('<li><button data-syndicate-to="'+(uid ? uid : target)+'" class="btn btn-default btn-block">'+(favicon ? '<img src="'+favicon+'" width="16" height="16"> ':'')+target+'</button></li>');
+        $("#syndication-container ul").append('<li><button data-syndicate-to="'+htmlspecialchars(uid ? uid : target)+'" class="btn btn-default btn-block">'+(favicon ? '<img src="'+htmlspecialchars(favicon)+'" width="16" height="16"> ':'')+htmlspecialchars(target)+'</button></li>');
       }
       bind_syndication_buttons();
     } else {