motioneye-project / motioneye

A web frontend for the motion daemon.
GNU General Public License v3.0
3.99k stars 655 forks source link

Help Mark not HTML encoding strings #2856

Open leon-v opened 1 year ago

leon-v commented 1 year ago

https://github.com/motioneye-project/motioneye/blob/85bec7b61e0cb73ffacd55af6dcbc114ddac9849/motioneye/templates/main.html#L47

Screenshot 2023-10-12 at 9 00 01 AM

Double quotes here are being seen by the browser as the end of the attribute value. All strings in HTML should be HTML encoded before being rendered.