From 9aa44fa9441071b840093edb64b8b4405a479e03 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Tue, 9 Jul 2013 13:55:29 +0200
Subject: [PATCH] Some escaping

---
 src/root/users.tt | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/root/users.tt b/src/root/users.tt
index f9178b8e..45f5e5e7 100644
--- a/src/root/users.tt
+++ b/src/root/users.tt
@@ -4,7 +4,7 @@
 <table class="table table-striped table-condensed clickable-rows">
   <thead>
     <tr>
-      <th>Username</th>
+      <th>User name</th>
       <th>Name</th>
       <th>Email</th>
       <th>Roles</th>
@@ -14,9 +14,9 @@
   <tbody>
     [% FOREACH u IN users %]
       <tr>
-        <td><a class="row-link" href="[% c.uri_for(c.controller('User').action_for('edit'), [u.username]) %]">[% u.username %]</a></td>
-        <td>[% u.fullname %]</td>
-        <td>[% u.emailaddress %]</td>
+        <td><a class="row-link" href="[% c.uri_for(c.controller('User').action_for('edit'), [u.username]) %]">[% HTML.escape(u.username) %]</a></td>
+        <td>[% HTML.escape(u.fullname) %]</td>
+        <td>[% HTML.escape(u.emailaddress) %]</td>
         <td>[% FOREACH r IN u.userroles %]<i>[% r.role %]</i> [% END %]</td>
         <td>[% IF u.emailonerror %]Yes[% ELSE %]No[% END %]</td>
       </tr>