From 060f1b7728a0983cc010eacebdb94f0a440d98f1 Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kitenet.net>
Date: Fri, 25 Oct 2013 18:12:14 -0400
Subject: [PATCH 2/2] also need to escape the HOSTNAME

Also escaped the domain for good measure.
---
 templates/branchable.tmpl   | 6 +++---
 templates/controlpanel.tmpl | 4 ++--
 templates/makesite.tmpl     | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/templates/branchable.tmpl b/templates/branchable.tmpl
index 22dc2a3..55bd781 100644
--- a/templates/branchable.tmpl
+++ b/templates/branchable.tmpl
@@ -17,7 +17,7 @@ but will be subject to verification.
 <p>
 Users with <a href="/ikiwiki.cgi?do=setupsshkeys">configured ssh keys</a> can modify the git repository:
 <pre>
-git clone <TMPL_VAR GITSSHURL> <TMPL_VAR HOSTNAME>
+git clone <TMPL_VAR GITSSHURL> <TMPL_VAR HOSTNAME ESCAPE=HTML>
 </pre>
 </p>
 
@@ -37,8 +37,8 @@ then change it as desired.
 <p>
 <form action="<TMPL_VAR CONTROLSITECGIURL>">
 <input type="hidden" name="do" value="branchsite" />
-<input type="hidden" name="branchof" value="<TMPL_VAR HOSTNAME>" />
-I want a branch of <TMPL_VAR HOSTNAME> named
+<input type="hidden" name="branchof" value="<TMPL_VAR HOSTNAME ESCAPE=HTML>" />
+I want a branch of <TMPL_VAR HOSTNAME ESCAPE=HTML> named
 <input name="hostname" size="40" placeholder="example.com" />
 <input type="hidden" name="domain" value="ikiwiki.info" />
 <input type="submit" name="submit" value="Create it now!" />
diff --git a/templates/controlpanel.tmpl b/templates/controlpanel.tmpl
index 2e5f078..f227d2b 100644
--- a/templates/controlpanel.tmpl
+++ b/templates/controlpanel.tmpl
@@ -100,10 +100,10 @@ Balance: $<TMPL_VAR BALANCE>
 </td>
 <td class="siteinfo">
 <div class="sitename">
-<a href="<TMPL_VAR SITE_URL>"><TMPL_VAR SITE_WIKINAME></a>
+<a href="<TMPL_VAR SITE_URL>"><TMPL_VAR SITE_WIKINAME ESCAPE=HTML></a>
 </div>
 <div class="sitedomain">
-<a href="<TMPL_VAR SITE_URL>"><TMPL_VAR SITE_DOMAIN></a>
+<a href="<TMPL_VAR SITE_URL>"><TMPL_VAR SITE_DOMAIN ESCAPE=HTML></a>
 </div>
 <div class="sitehistory">
 <TMPL_IF SITE_PARENT>Branched<TMPL_ELSE>Created</TMPL_IF>
diff --git a/templates/makesite.tmpl b/templates/makesite.tmpl
index 2559caa..74337b4 100644
--- a/templates/makesite.tmpl
+++ b/templates/makesite.tmpl
@@ -6,8 +6,8 @@
 <input type="hidden" name="ready" value="<TMPL_VAR READY>" />
 <input type="hidden" name="retry" value="1" />
 <input type="hidden" name="type" value="<TMPL_VAR TYPE>" />
-<input type="hidden" name="hostname" value="<TMPL_VAR HOSTNAME>" />
-<input type="hidden" name="domain" value="<TMPL_VAR DOMAIN>" />
+<input type="hidden" name="hostname" value="<TMPL_VAR HOSTNAME ESCAPE=HTML>" />
+<input type="hidden" name="domain" value="<TMPL_VAR DOMAIN ESCAPE=HTML>" />
 <input type="hidden" name="internal_hostname" value="<TMPL_VAR INTERNAL_HOSTNAME ESCAPE=HTML>" />
 
 <div class="notice">
-- 
1.8.4.rc3