Merge pull request #19022 from MrStonedOne/patch-224

[s]VV now escapes name (because name could be an item in a list)
This commit is contained in:
Joan Lung
2016-06-30 20:15:20 -04:00
committed by GitHub
+9 -9
View File
@@ -354,10 +354,10 @@ body
html += "<li>"
if (isnull(value))
html += "[name] = <span class='value'>null</span>"
html += "[html_encode(name)] = <span class='value'>null</span>"
else if (istext(value))
html += "[name] = <span class='value'>\"[html_encode(value)]\"</span>"
html += "[html_encode(name)] = <span class='value'>\"[html_encode(value)]\"</span>"
else if (isicon(value))
#ifdef VARSICON
@@ -365,9 +365,9 @@ body
var/rnd = rand(1,10000)
var/rname = "tmp\ref[I][rnd].png"
usr << browse_rsc(I, rname)
html += "[name] = (<span class='value'>[value]</span>) <img class=icon src=\"[rname]\">"
html += "[html_encode(name)] = (<span class='value'>[value]</span>) <img class=icon src=\"[rname]\">"
#else
html += "[name] = /icon (<span class='value'>[value]</span>)"
html += "[html_encode(name)] = /icon (<span class='value'>[value]</span>)"
#endif
/* else if (istype(value, /image))
@@ -382,19 +382,19 @@ body
#endif
*/
else if (isfile(value))
html += "[name] = <span class='value'>'[value]'</span>"
html += "[html_encode(name)] = <span class='value'>'[value]'</span>"
else if (istype(value, /datum))
var/datum/D = value
html += "<a href='?_src_=vars;Vars=\ref[value]'>[name] \ref[value]</a> = [D.type]"
html += "<a href='?_src_=vars;Vars=\ref[value]'>[html_encode(name)] \ref[value]</a> = [D.type]"
else if (istype(value, /client))
var/client/C = value
html += "<a href='?_src_=vars;Vars=\ref[value]'>[name] \ref[value]</a> = [C] [C.type]"
html += "<a href='?_src_=vars;Vars=\ref[value]'>[html_encode(name)] \ref[value]</a> = [C] [C.type]"
//
else if (istype(value, /list))
var/list/L = value
html += "[name] = /list ([L.len])"
html += "[html_encode(name)] = /list ([L.len])"
if (L.len > 0 && !(name == "underlays" || name == "overlays" || name == "vars" || L.len > 500))
// not sure if this is completely right...
@@ -414,7 +414,7 @@ body
html += "</ul>"
else
html += "[name] = <span class='value'>[html_encode(value)]</span>"
html += "[html_encode(name)] = <span class='value'>[html_encode(value)]</span>"
html += "</li>"