mirror of
https://github.com/beetbox/beets.git
synced 2026-09-17 00:09:31 -05:00
Replace all `<%= %>` (unescaped) with `<%- %>` (escaped) in Underscore.js templates to prevent cross-site scripting via music metadata fields.
Replace all `<%= %>` (unescaped) with `<%- %>` (escaped) in Underscore.js templates to prevent cross-site scripting via music metadata fields.