Fix referer escaping

2019-05-03 12:15:21 -05:00
parent 757ea93393
commit ad8750b40d
6 changed files with 6 additions and 6 deletions
--- a/src/invidious/views/preferences.ecr
+++ b/src/invidious/views/preferences.ecr
@@ -9,7 +9,7 @@ function update_value(element) {
 </script>

 <div class="h-box">
-    <form class="pure-form pure-form-aligned" action="/preferences?referer=<%= referer %>" method="post">
+    <form class="pure-form pure-form-aligned" action="/preferences?referer=<%= URI.escape(referer) %>" method="post">
        <fieldset>
            <legend><%= translate(locale, "Player preferences") %></legend>