From aebf70ed75dbbe1fbbf0f72f7d9f94f08aab0ed5 Mon Sep 17 00:00:00 2001
From: Martin Ashby <martin@ashbysoft.com>
Date: Fri, 30 Dec 2022 10:32:46 +0000
Subject: Use URLSearchParams to sanitize query params

---
 themes/XMin/layouts/partials/foot_custom.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'themes')

diff --git a/themes/XMin/layouts/partials/foot_custom.html b/themes/XMin/layouts/partials/foot_custom.html
index 754b722..eb0962a 100644
--- a/themes/XMin/layouts/partials/foot_custom.html
+++ b/themes/XMin/layouts/partials/foot_custom.html
@@ -17,14 +17,16 @@
 <div style="visibility: hidden" id="comment_form">comment form goes here</div>
 <script>
      let comments = document.getElementById("comments");
-     fetch(document.location.origin + "/api/comment?url=" + document.location.href)
+     let urlParam = new URLSearchParams();
+     urlParam.append("url", document.location.href);
+     fetch(document.location.origin + "/api/comment?" + urlParam.toString())
           .then((response) => response.text())
           .then((data) => {
                comments.innerHTML = data;
                comments.style.visibility = "visible";
           });
      let form = document.getElementById("comment_form");
-     fetch(document.location.origin + "/api/form?url=" + document.location.href)
+     fetch(document.location.origin + "/api/form?" + urlParam.toString())
           .then((response) => response.text())
           .then((data) => {
                form.innerHTML = data;
-- 
cgit v1.2.3-ZIG