Escape post title

boards/templates/boards/post.html

@@ -1,166 +1,166 b''
 {% load i18n %}
 {% load board %}
 
 {% get_current_language as LANGUAGE_CODE %}
 
 {% autoescape off %}
 <div class="{{ css_class }}" id="{{ post.id }}" data-uid="{{ post.uid }}" {% if tree_depth %}style="margin-left: {{ tree_depth }}em;"{% endif %}>
     <div class="post-info">
         <a class="post_id" href="{{ post.get_absolute_url }}">#{{ post.id }}</a>
         {% if is_opening and thread.is_stickerpack %}
             &#128247;
         {% endif %}
-        <span class="title">{{ post.title }}</span>
+        <span class="title">{{ post.title|escape }}</span>
         {% if perms.boards.change_post and post.has_ip %}
             <span class="pub_time" style="border-bottom: solid 2px #{{ post.get_ip_color }};" title="{{ post.poster_ip }}">
         {% else %}
             <span class="pub_time">
         {% endif %}
         <time datetime="{{ post.pub_time|date:'c' }}">{{ post.pub_time }}</time></span>
         {% if post.tripcode %}
             /
             {% with tripcode=post.get_tripcode %}
                 <a href="{% url 'feed' %}?tripcode={{ tripcode.get_full_text }}"
                    class="tripcode" title="{{ tripcode.get_full_text }}"
                    style="border: solid 2px #{{ tripcode.get_color }}; border-left: solid 1ex #{{ tripcode.get_color }};">{{ tripcode.get_short_text }}</a>
             {% endwith %}
         {% endif %}
         {% comment %}
             Thread death time needs to be shown only if the thread is alredy archived
             and this is an opening post (thread death time) or a post for popup
             (we don't see OP here so we show the death time in the post itself).
         {% endcomment %}
         {% if is_opening and thread.is_archived %}
             — <time datetime="{{ thread.bump_time|date:'c' }}">{{ thread.bump_time }}</time>
         {% endif %}
         {% if is_opening %}
             {% if need_open_link %}
                 {% if thread.is_archived %}
                     <a class="link" href="{% url 'thread' post.id %}">{% trans "Open" %}</a>
                 {% else %}
                     <a class="link" href="{% url 'thread' post.id %}#form">{% trans "Reply" %}</a>
                 {% endif %}
             {% endif %}
         {% else %}
             {% if need_op_data %}
                 {% with thread.get_opening_post as op %}
                     {% trans " in " %}{{ op.get_link_view|safe }} <span class="title">{{ op.get_title_or_text }}</span>
                 {% endwith %}
             {% endif %}
         {% endif %}
         {% if reply_link and not thread.is_archived %}
             <a href="#form" onclick="addQuickReply('{{ post.id }}'); return false;">{% trans 'Reply' %}</a>
         {% endif %}
 
         {% if perms.boards.change_post or perms.boards.delete_post or perms.boards.change_thread or perms_boards.delete_thread %}
         <a class="moderation-menu" href="#">🔒</a>
             <script>
                 $.contextMenu({
                     selector: '#{{ post.id }} .moderation-menu',
                     trigger: 'left',
                     build: function($trigger, e) {
                         return {
                             items: {
                                 edit: {
                                     name: '{% trans "Edit" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_post_change' post.id %}';
                                     },
                                     visible: {% if perms.boards.change_post %}true{% else %}false{% endif %}
                                 },
                                 deletePost: {
                                     name: '{% trans "Delete post" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_post_delete' post.id %}';
                                     },
                                     visible: {% if not is_opening and perms.boards.delete_post %}true{% else %}false{% endif %}
                                 },
                                 editThread: {
                                     name: '{% trans "Edit thread" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_thread_change' thread.id %}';
                                     },
                                     visible: {% if is_opening and perms.boards.change_thread %}true{% else %}false{% endif %}
                                 },
                                 deleteThread: {
                                     name: '{% trans "Delete thread" %}',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'admin:boards_thread_delete' thread.id %}';
                                     },
                                     visible: {% if is_opening and perms.boards.delete_thread %}true{% else %}false{% endif %}
                                 },
                                 findByIp: {
                                     name: 'IP = {{ post.poster_ip }}',
                                     callback: function(key, opt) {
                                         window.location = '{% url "feed" %}?ip={{ post.poster_ip }}';
                                     },
                                     visible: {% if post.has_ip %}true{% else %}false{% endif %}
                                 },
                                 raw: {
                                     name: 'RAW',
                                     callback: function(key, opt) {
                                         window.location = '{% url 'post_sync_data' post.id %}';
                                     },
                                     visible: {% if post.global_id_id %}true{% else %}false{% endif %}
                                 },
                                 ban: {
                                     name: '{% trans "Ban" %}',
                                     callback: function(key, opt) {
                                         if (confirm('{% trans "Are you sure?" %}')) {
                                             window.location = '{% url 'utils' %}?method=ban&post_id={{ post.id }}';
                                         }
                                     },
                                     visible: {% if post.has_ip %}true{% else %}false{% endif %}
                                 },
                                 banAndDelete: {
                                     name: '{% trans "Ban and delete" %}',
                                     callback: function(key, opt) {
                                         if (confirm('{% trans "Are you sure?" %}')) {
                                             window.location = '{% url 'utils' %}?method=ban_and_delete&post_id={{ post.id }}';
                                         }
                                     },
                                     visible: {% if post.has_ip %}true{% else %}false{% endif %}
                                 }
                             }
                         };
                     }
                 });
             </script>
         {% endif %}
     </div>
     {% for file in post.attachments.all %}
         {{ file.get_view|safe }}
     {% endfor %}
     {% comment %}
         Post message (text)
     {% endcomment %}
     <div class="message">
         {% if truncated %}
             {{ post.get_text|truncatewords_html:50|truncatenewlines_html:3|safe }}
         {% else %}
             {{ post.get_text|safe }}
         {% endif %}
     </div>
     {% if post.is_referenced and not mode_tree %}
         <div class="refmap">
             {% trans "Replies" %}: {{ post.refmap|safe }}
         </div>
     {% endif %}
     {% comment %}
         Thread metadata: counters, tags etc
     {% endcomment %}
     {% if is_opening %}
         <div class="metadata">
             {% if need_open_link %}
                 ♥ {{ thread.get_reply_count }}
                 ❄ {{ thread.get_images_count }}
                 <a href="{% url 'thread_gallery' post.id %}">G</a>
                 <a href="{% url 'thread_tree' post.id %}">T</a>
             {% endif %}
             <span class="tags">
                 {{ thread.get_tag_url_list|safe }}
             </span>
         </div>
     {% endif %}
 </div>
 {% endautoescape %}
  No newline at end of file