From 8b2d2044b299ed9bfe163673e209f039bcda1239 Mon Sep 17 00:00:00 2001
From: Omar Roth <omarroth@hotmail.com>
Date: Sun, 11 Mar 2018 10:47:48 -0500
Subject: [PATCH] Escape title name

---
 src/views/player/audio.ecr | 2 +-
 src/views/player/video.ecr | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/views/player/audio.ecr b/src/views/player/audio.ecr
index 1122d8d0..35273a61 100644
--- a/src/views/player/audio.ecr
+++ b/src/views/player/audio.ecr
@@ -1,4 +1,4 @@
-<audio poster="<%= thumbnail %>" title="<%= video.title%>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
+<audio poster="<%= thumbnail %>" title="<%= HTML.escape(video.title) %>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
     <% adaptive_fmts.each do |fmt| %>
         <% if fmt["type"].starts_with?("audio") %>
             <source src="<%= fmt["url"] %>" type='<%= fmt["type"] %>'>
diff --git a/src/views/player/video.ecr b/src/views/player/video.ecr
index 8e17711f..90abe438 100644
--- a/src/views/player/video.ecr
+++ b/src/views/player/video.ecr
@@ -1,4 +1,4 @@
-<video poster="<%= thumbnail %>" title="<%= video.title%>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
+<video poster="<%= thumbnail %>" title="<%= HTML.escape(video.title) %>" id="player" class="video-js" data-setup="{}" style="width:100%;" controls>
     <% fmt_stream.each do |fmt| %>
         <source src="<%= fmt["url"]? %>" type='<%= fmt["type"]? %>'>
     <% end %>