From 641b694d59648b607e8ab8ef44a91094b99202b9 Mon Sep 17 00:00:00 2001
From: f0x52 <0x52@waifu.club>
Date: Mon, 17 Apr 2017 22:15:45 +0200
Subject: [PATCH 1/2] issue #94, mod edit form

---
 templates/mod/edit_post_form.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/mod/edit_post_form.html b/templates/mod/edit_post_form.html
index a2980d35..0261ba69 100644
--- a/templates/mod/edit_post_form.html
+++ b/templates/mod/edit_post_form.html
@@ -23,7 +23,7 @@
 				{% trans %}Subject{% endtrans %}
 			</th>
 			<td>
-				<input style="float:left;" type="text" name="subject" size="25" maxlength="100" autocomplete="off" value="{{ post.subject }}">
+				<input style="float:left;" type="text" name="subject" size="25" maxlength="100" autocomplete="off" value="{{ post.subject|e }}">
 				<input accesskey="s" style="margin-left:2px;" type="submit" name="post" value="{% trans %}Update{% endtrans %}">
 			</td>
 		</tr>

From e3b3e1601c8ce1a8178fec43de89b707d0e66b62 Mon Sep 17 00:00:00 2001
From: f0x52 <0x52@waifu.club>
Date: Mon, 17 Apr 2017 22:30:14 +0200
Subject: [PATCH 2/2] escaping on all fields

---
 templates/mod/edit_post_form.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/templates/mod/edit_post_form.html b/templates/mod/edit_post_form.html
index 0261ba69..a22f36f3 100644
--- a/templates/mod/edit_post_form.html
+++ b/templates/mod/edit_post_form.html
@@ -7,7 +7,7 @@
 				{% trans %}Name{% endtrans %}
 			</th>
 			<td>
-				<input type="text" name="name" size="25" maxlength="35" autocomplete="off" value="{{ post.name }}">
+				<input type="text" name="name" size="25" maxlength="35" autocomplete="off" value="{{ post.name|e }}">
 			</td>
 		</tr>
 		<tr>
@@ -15,7 +15,7 @@
 				{% trans %}Email{% endtrans %}
 			</th>
 			<td>
-				<input type="text" name="email" size="25" maxlength="40" autocomplete="off" value="{{ post.email }}">
+				<input type="text" name="email" size="25" maxlength="40" autocomplete="off" value="{{ post.email|e }}">
 			</td>
 		</tr>
 		<tr>
@@ -32,7 +32,7 @@
 				{% trans %}Comment{% endtrans %}
 			</th>
 			<td>
-				<textarea name="body" id="body" rows="8" cols="35">{% if raw %}{{ post.body }}{% else %}{{ post.body_nomarkup }}{% endif %}</textarea>
+				<textarea name="body" id="body" rows="8" cols="35">{% if raw %}{{ post.body|e }}{% else %}{{ post.body_nomarkup|e }}{% endif %}</textarea>
 			</td>
 		</tr>
 	</table>