From fcf377d26b3e54c9b5f72d0a3c497d9504259f56 Mon Sep 17 00:00:00 2001
From: Omar Roth <omarroth@protonmail.com>
Date: Sat, 15 Jun 2019 20:42:42 -0500
Subject: [PATCH] Fix escaping for login page

---
 src/invidious/views/login.ecr | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/invidious/views/login.ecr b/src/invidious/views/login.ecr
index 7fa252784..7e2c2e214 100644
--- a/src/invidious/views/login.ecr
+++ b/src/invidious/views/login.ecr
@@ -32,7 +32,7 @@
                         <% end %>
 
                         <% if password %>
-                            <input name="password" type="hidden" value="<%= password %>">
+                            <input name="password" type="hidden" value="<%= HTML.escape(password) %>">
                         <% else %>
                             <label for="password"><%= translate(locale, "Password") %> :</label>
                             <input required class="pure-input-1" name="password" type="password" placeholder="<%= translate(locale, "Password") %>">
@@ -95,7 +95,7 @@
                         <% end %>
 
                         <% if password %>
-                            <input name="password" type="hidden" value="<%= password %>">
+                            <input name="password" type="hidden" value="<%= HTML.escape(password) %>">
                         <% else %>
                             <label for="password"><%= translate(locale, "Password") %> :</label>
                             <input required class="pure-input-1" name="password" type="password" placeholder="<%= translate(locale, "Password") %>">