From: Lars Dɪᴇᴄᴋᴏᴡ 迪拉斯 <daxim@cpan.org>
Date: Tue, 15 Feb 2011 15:02:35 +0000 (+0100)
Subject: RT #62095: prevent XSS
X-Git-Tag: v5.8006~16
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=3ce71ea74b728526f61ca42289175323bc5b5360;p=catagits%2FCatalyst-Manual.git

RT #62095: prevent XSS

https://rt.cpan.org/Ticket/Display.html?id=62095
---

diff --git a/lib/Catalyst/Manual/Tutorial/04_BasicCRUD.pod b/lib/Catalyst/Manual/Tutorial/04_BasicCRUD.pod
index f7f5f1b..50f1be4 100644
--- a/lib/Catalyst/Manual/Tutorial/04_BasicCRUD.pod
+++ b/lib/Catalyst/Manual/Tutorial/04_BasicCRUD.pod
@@ -886,7 +886,7 @@ query parameter:
     ...
     <div id="content">
         [%# Status and error messages %]
-        <span class="message">[% status_msg || c.request.params.status_msg %]</span>
+        <span class="message">[% status_msg || c.request.params.status_msg | html %]</span>
         <span class="error">[% error_msg %]</span>
         [%# This is where TT will stick all of your template's contents. -%]
         [% content %]