filters: quote param names and values when constructing querystrings

[patchwork] / templates / patchwork / patch-list.html

diff --git a/templates/patchwork/patch-list.html b/templates/patchwork/patch-list.html
index d4dd325c61fc4899548dd3cb00edc4495f2c7480..fe4d6060e4cd5a16670ace0e06df834db810cae1 100644 (file)
--- a/templates/patchwork/patch-list.html
+++ b/templates/patchwork/patch-list.html
@@ -12,6 +12,7 @@
  {% if order.editable %}
   <td class="patchlistreorder">
    <form method="post" id="reorderform">
+    {% csrf_token %}
     <input type="hidden" name="form" value="reorderform"/>
     <input type="hidden" name="order_start" value="0"/>
     <span id="reorderhelp"></span>
@@ -33,6 +34,7 @@
 {% endif %}
 
 <form method="post">
+{% csrf_token %}
 <input type="hidden" name="form" value="patchlistform"/>
 <input type="hidden" name="project" value="{{project.id}}"/>
 <table class="patchlist" id="patchlist">
@@ -142,7 +144,7 @@
     </td>
     {% endif %}
    <td><a href="{% url patchwork.views.patch.patch patch_id=patch.id %}"
-     >{{ patch.name }}</a></td>
+     >{{ patch.name|default:"[no subject]" }}</a></td>
    <td>{{ patch.date|date:"Y-m-d" }}</td>
    <td>{{ patch.submitter|personify }}</td>
    <td>{{ patch.delegate.username }}</td>