Use the vars' version when building the comment link

Otherwise, the object versions won't be sanitize()d, and can contain
malicious code.

Signed-off-by: Alberto Bertogli <albertito@blitiri.com.ar>

diff --git a/blitiri.cgi b/blitiri.cgi
index 8ce429868956d2b0b5cd5be87c958816bd6022ca..60c86ea49aa3a9ee8735b6d59d3d7964c1a1010f 100755 (executable)
--- a/blitiri.cgi
+++ b/blitiri.cgi
@@ -615,9 +615,9 @@ class Templates (object):
                vars = comment.to_vars()
                if comment.link:
                        vars['linked_author'] = '<a href="%s">%s</a>' \
-                                       % (comment.link, comment.author)
+                                       % (vars['link'], vars['author'])
                else:
-                       vars['linked_author'] = comment.author
+                       vars['linked_author'] = vars['author']
                return self.get_template(
                        'com_header', default_comment_header, vars)