From 1df9a99481515fc774a784c25c7927c4a7450e88 Mon Sep 17 00:00:00 2001
From: Andrey Kozlov <yecli.github@gmail.com>
Date: Wed, 13 May 2020 19:23:34 +0500
Subject: [PATCH] VP-2180: Prevent XSS in paginator

---
 snippets/pagination-custom.liquid | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/snippets/pagination-custom.liquid b/snippets/pagination-custom.liquid
index 217ea1c9..1f2b87cb 100644
--- a/snippets/pagination-custom.liquid
+++ b/snippets/pagination-custom.liquid
@@ -1,6 +1,6 @@
 <ul class="pagination-custom">
     {% if paginator.previous %}
-        <li><a href="{{ paginator.previous.url }}" title="{{ paginator.previous.title }}">&larr;</a></li>
+        <li><a href="{{ paginator.previous.url | escape }}" title="{{ paginator.previous.title | escape }}">&larr;</a></li>
     {% else %}
         <li class="disabled"><span>&larr;</span></li>
     {% endif %}
@@ -8,19 +8,19 @@
     {% for part in paginator.parts %}
         {% if part.is_link %}
             <li>
-                <a href="{{ part.url }}" title="">{{ part.title }}</a>
+                <a href="{{ part.url  | escape }}" title="">{{ part.title | escape }}</a>
             </li>
         {% else %}
             {% if part.title == paginator.current_page %}
-                <li class="active"><span>{{ part.title }}</span></li>
+                <li class="active"><span>{{ part.title | escape }}</span></li>
             {% else %}
-                <li><span>{{ part.title }}</span></li>
+                <li><span>{{ part.title | escape }}</span></li>
             {% endif %}
         {% endif %}
     {% endfor %}
 
     {% if paginator.next %}
-        <li><a href="{{ paginator.next.url }}" title="{{ paginator.next.title }}">&rarr;</a></li>
+        <li><a href="{{ paginator.next.url | escape }}" title="{{ paginator.next.title | escape }}">&rarr;</a></li>
     {% else %}
         <li class="disabled"><span>&rarr;</span></li>
     {% endif %}