Fix XSS in openid selector. Thanks, Raghav Bisht.

[git.ikiwiki.info.git] / templates / comment.tmpl

diff --git a/templates/comment.tmpl b/templates/comment.tmpl
index 39cba0ff92ad99bc59baecd6b6b7fa34deb76676..c16ca7c810c78f6cabac99bfed6b5bfb19c8b72c 100644 (file)
--- a/templates/comment.tmpl
+++ b/templates/comment.tmpl
@@ -1,5 +1,9 @@
-<TMPL_IF HTML5><article class="comment" id="<TMPL_VAR NAME=COMMENTID>">
-<TMPL_ELSE><div class="comment" id="<TMPL_VAR NAME=COMMENTID>"></TMPL_IF>
+<TMPL_IF HTML5><article class="comment" id="<TMPL_VAR COMMENTID>">
+<TMPL_ELSE><div class="comment" id="<TMPL_VAR COMMENTID>"></TMPL_IF>
+
+<TMPL_IF COMMENTAUTHORAVATAR><div class="comment-avatar">
+<img src="<TMPL_VAR COMMENTAUTHORAVATAR>" alt="" />
+</div></TMPL_IF>

 
 <TMPL_IF HTML5><header class="comment-subject"><TMPL_ELSE><div class="comment-subject"></TMPL_IF>
 <TMPL_IF PERMALINK>
 
 <TMPL_IF HTML5><header class="comment-subject"><TMPL_ELSE><div class="comment-subject"></TMPL_IF>
 <TMPL_IF PERMALINK>


@@ -14,45 +18,49 @@
 <TMPL_IF HTML5></section><TMPL_ELSE></div></TMPL_IF>
 
 <TMPL_IF HTML5><header class="comment-header"><TMPL_ELSE><div class="comment-header"></TMPL_IF>
 <TMPL_IF HTML5></section><TMPL_ELSE></div></TMPL_IF>
 
 <TMPL_IF HTML5><header class="comment-header"><TMPL_ELSE><div class="comment-header"></TMPL_IF>

+<TMPL_IF COMMENTUSER>

 Comment by
 Comment by

-<TMPL_IF NAME="COMMENTUSER">
-<TMPL_IF NAME="COMMENTOPENID">
+<TMPL_IF COMMENTOPENID>

 <span class="author" title="OpenID">
 <span class="author" title="OpenID">

-<a href="<TMPL_VAR NAME=COMMENTOPENID>"><TMPL_VAR NAME=COMMENTAUTHOR></a>
+<a href="<TMPL_VAR COMMENTOPENID>"><TMPL_VAR COMMENTAUTHOR></a>

 </span>
 <TMPL_ELSE>
 <span class="author" title="Signed in">
 </span>
 <TMPL_ELSE>
 <span class="author" title="Signed in">

-<TMPL_IF NAME="COMMENTAUTHORURL">
-<a href="<TMPL_VAR NAME=COMMENTAUTHORURL>"><TMPL_VAR NAME=COMMENTAUTHOR></a>
+<TMPL_IF COMMENTAUTHORURL>
+<a href="<TMPL_VAR COMMENTAUTHORURL>"><TMPL_VAR COMMENTAUTHOR></a>

 <TMPL_ELSE>
 <TMPL_ELSE>

-<TMPL_VAR NAME=COMMENTAUTHOR>
+<TMPL_VAR COMMENTAUTHOR>

 </TMPL_IF>
 </span>
 </TMPL_IF>
 <TMPL_ELSE>
 </TMPL_IF>
 </span>
 </TMPL_IF>
 <TMPL_ELSE>

-<TMPL_IF NAME=COMMENTIP>
-<span class="author" title="Unauthenticated, from <TMPL_VAR NAME=COMMENTIP>">
+<TMPL_IF AUTHOR>
+Comment by
+<TMPL_IF COMMENTIP>
+<span class="author" title="Unauthenticated, from <TMPL_VAR COMMENTIP>">

 <TMPL_ELSE>
 <span class="author" title="Unauthenticated, from unknown IP address">
 </TMPL_IF>
 <TMPL_ELSE>
 <span class="author" title="Unauthenticated, from unknown IP address">
 </TMPL_IF>

-<TMPL_IF NAME="AUTHORURL">
-<a href="<TMPL_VAR NAME=AUTHORURL>"><TMPL_VAR NAME=AUTHOR></a>
+<TMPL_IF AUTHORURL>
+<a href="<TMPL_VAR AUTHORURL>"><TMPL_VAR AUTHOR></a>

 <TMPL_ELSE>
 <TMPL_ELSE>

-<TMPL_VAR NAME=AUTHOR>
+<TMPL_VAR AUTHOR>
+</TMPL_IF>

 </TMPL_IF>
 </span>
 </TMPL_IF>
 &mdash; <TMPL_VAR CTIME>
 <TMPL_IF HTML5></header><TMPL_ELSE></div></TMPL_IF>
 
 </TMPL_IF>
 </span>
 </TMPL_IF>
 &mdash; <TMPL_VAR CTIME>
 <TMPL_IF HTML5></header><TMPL_ELSE></div></TMPL_IF>
 

-<TMPL_IF NAME="HAVE_ACTIONS">
+<TMPL_IF HAVE_ACTIONS>

 <TMPL_IF HTML5><nav class="actions"><TMPL_ELSE><div class="actions"></TMPL_IF>
 <ul>
 <TMPL_IF HTML5><nav class="actions"><TMPL_ELSE><div class="actions"></TMPL_IF>
 <ul>

-<TMPL_IF NAME="REMOVEURL">
+<TMPL_IF REMOVEURL>

 <li><a href="<TMPL_VAR REMOVEURL>" rel="nofollow">Remove comment</a></li>
 </TMPL_IF>
 </ul>
 <TMPL_IF HTML5></nav><TMPL_ELSE></div></TMPL_IF>
 </TMPL_IF>
 
 <li><a href="<TMPL_VAR REMOVEURL>" rel="nofollow">Remove comment</a></li>
 </TMPL_IF>
 </ul>
 <TMPL_IF HTML5></nav><TMPL_ELSE></div></TMPL_IF>
 </TMPL_IF>
 

+<div style="clear: both"></div>

 <TMPL_IF HTML5></article><TMPL_ELSE></div></TMPL_IF>
 <TMPL_IF HTML5></article><TMPL_ELSE></div></TMPL_IF>