mirror of
https://github.com/beetbox/beets.git
synced 2026-07-21 01:36:52 -04:00
Replace all `<%= %>` (unescaped) with `<%- %>` (escaped) in Underscore.js templates to prevent cross-site scripting via music metadata fields.
Replace all `<%= %>` (unescaped) with `<%- %>` (escaped) in Underscore.js templates to prevent cross-site scripting via music metadata fields.