diff --git a/main.py b/main.py
index e84489d..d9676bb 100644
--- a/main.py
+++ b/main.py
@@ -9,6 +9,7 @@ import sys
import uuid
import json
import urllib.parse
+from markupsafe import escape
db_path = 'mate.db'
conn = sqlite3.connect(db_path, check_same_thread=False)
@@ -35,7 +36,7 @@ def exit_handler():
#website
@app.route("/")
def index():
- return 'user and tag list The creator of this website accepts no liability for any linguistic or technical errors!
Doumentation'
+ return 'user anfrom markupsafe import escaped tag list The creator of this website accepts no liability for any linguistic or technical errors!
Doumentation'
@app.route("/list")
def list():
@@ -44,7 +45,7 @@ def list():
text = ""
for i in users:
username = urllib.parse.quote_plus(i[1])
- text = text + f'{username}: {i[2]}
'
+ text = text + f'{escape(i[1])}: {i[2]}
'
return '''
@@ -78,7 +79,7 @@ def user_info():
var socket = io();
""" + 'socket.on("update", function(){ window.location="http://matekasse.server.c3h/list/user?user=' + username + '"});' + f"""
- {user[1]} : {user[2]}
+
{escape(user[1])} : {user[2]}