marky

commit 58fb7a43091a0951bf0dea20950ff6895dd3f5a4
parent 618b9ef38b861f92769a5ab15e484d03710b6be3
Author: David Eisinger <[email protected]>
Date:   Sat, 11 Oct 2025 17:02:14 -0400

Fix bookmarklet & escaping issue

Diffstat:
M
internal/api.go
 | 
10
+++++-----

1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/internal/api.go b/internal/api.go
@@ -178,16 +178,16 @@ func NewHandlerWithConfig(db *DB, cfg HandlerConfig) (http.Handler, error) {
 		<h2>Add Bookmark</h2>
 		<form id="f">
 			<label>URL
-				<input id="url" type="text" required value=%[1]s>
+				<input id="url" type="text" required value="%[1]s">
 			</label>
 			<label>Title
-				<input id="title" type="text" required value=%[2]s>
+				<input id="title" type="text" required value="%[2]s">
 			</label>
 			<label>Description
 				<textarea id="desc">%[3]s</textarea>
 			</label>
 			<label>Referrer
-				<input id="ref" type="text" value=%[8]s placeholder="https://site-that-linked-here.example">
+				<input id="ref" type="text" value="%[8]s" placeholder="https://site-that-linked-here.example">
 			</label>
 			<label><input id="pub" type="checkbox" %[4]s> Public</label>
 			<div class="actions">
@@ -240,12 +240,12 @@ func NewHandlerWithConfig(db *DB, cfg HandlerConfig) (http.Handler, error) {
 		  });
 		})();
 		</script>
-		</html>`, enc(pageURL), enc(pageTitle), htmlEscape(desc), func() string {
+		</html>`, htmlEscape(pageURL), htmlEscape(pageTitle), htmlEscape(desc), func() string {
 			if strings.EqualFold(pub, "1") || strings.EqualFold(pub, "true") {
 				return "checked"
 			}
 			return ""
-		}(), origin, jsToken, jsUser, enc(refParam))
+		}(), origin, jsToken, jsUser, htmlEscape(refParam))
 	})
 
 	// API token endpoint for logged-in user (regenerate only)