idno/idno — pull request #515 by markharding (2014-10-09 15:50:19+00:00)
Title: fixes a couple of found XSS flaws

I've not had chance to really get my head around the structure of the code so this is just a quick hack to get a round the problem. There are a number of places where user generated content is outputted unescaped, which leads to an XSS vulnerability.

I'd probably suggest creating a global wrapper function for all user outputs so its escaped by default, these were just two places I could easily perform the attack.

See how I can call the console log here - http://markharding.withknown.com/2014/consolelogok#comments.