claude-bot
3f4bcf52d0
P1: views were emitting <%- JSON.stringify(...) %> directly inside <script> tags. A video title like "</script><script>alert(1)</script>" would break out of the script and inject HTML. Added res.locals.jsonForScript() that escapes <, >, &, U+2028, U+2029 before output and switched all three templates (op/editor.ejs, op/folder.ejs, folder.ejs) to use it. P2: The internal popup player in /folder/:name always hit /api/video/:id/file which returned the original. Made the file endpoint default to the edited variant when present and only fall back to original when ?edited=0 is given. Editor page passes ?edited=0 explicitly so the operator always re-trims from the original. Standalone /player/:id no longer needs the ?edited=1 hint. Verified: rendered editor HTML escapes </script> payloads to \u003c/script, default file endpoint serves edited.mp4 while ?edited=0 serves original.mp4. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
30 lines
913 B
Plaintext
30 lines
913 B
Plaintext
<!doctype html>
|
|
<html lang="ko">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title><%= video.title %> · 재생</title>
|
|
<link rel="stylesheet" href="/static/styles.css" />
|
|
</head>
|
|
<body class="siteBody">
|
|
<header class="publicNav">
|
|
<a class="navBrand" href="/">
|
|
<span class="navLogo">🎬</span>
|
|
<span class="navTitle">비디오 사이트</span>
|
|
</a>
|
|
<a class="secondaryButton" href="/folder/<%= encodeURIComponent(folder) %>">폴더로</a>
|
|
</header>
|
|
|
|
<main class="pageWrap">
|
|
<section class="hero">
|
|
<a class="muted" href="/folder/<%= encodeURIComponent(folder) %>">← <%= folder %></a>
|
|
<h1><%= video.title %></h1>
|
|
</section>
|
|
|
|
<div class="standalonePlayer">
|
|
<video controls autoplay preload="metadata" src="/api/video/<%= video.id %>/file"></video>
|
|
</div>
|
|
</main>
|
|
</body>
|
|
</html>
|