From 53711225ac9d116e72c159de943284fd55fe26e4 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Tue, 1 Sep 2009 01:28:52 -0700
Subject: XSS / style fixes for newly detected issues (after fixing XSS
 scanner)

---
 modules/comment/views/admin_comments.html.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'modules/comment')

diff --git a/modules/comment/views/admin_comments.html.php b/modules/comment/views/admin_comments.html.php
index f5970ae1..455cd714 100644
--- a/modules/comment/views/admin_comments.html.php
+++ b/modules/comment/views/admin_comments.html.php
@@ -1,7 +1,7 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <script type="text/javascript">
   var set_state_url =
-    "<?= url::site("admin/comments/set_state/__ID__/__STATE__?csrf=$csrf") ?>";
+    <?= html::js_string(url::site("admin/comments/set_state/__ID__/__STATE__?csrf=$csrf")) ?>;
   function set_state(state, id) {
     $.get(set_state_url.replace("__STATE__", state).replace("__ID__", id),
           {},
@@ -12,7 +12,7 @@
   }
 
   var delete_url =
-    "<?= url::site("admin/comments/delete/__ID__?csrf=$csrf") ?>";
+    <?= html::js_string(url::site("admin/comments/delete/__ID__?csrf=$csrf")) ?>;
 
   function del(id) {
     $.get(delete_url.replace("__ID__", id),
@@ -24,7 +24,7 @@
   }
 
   function update_menu() {
-    $.get("<?= url::site("admin/comments/menu_labels") ?>", {},
+    $.get(<?= html::js_string(url::site("admin/comments/menu_labels")) ?>, {},
           function(data) {
             for (var i = 0; i < data.length; i++) {
               $("#gAdminCommentsMenu li:eq(" + i + ") a").html(data[i]);
-- 
cgit v1.2.3