From 8ad20776ad6babf0fd66fab21cfce486da56a070 Mon Sep 17 00:00:00 2001
From: Valentin Popov <valentineus@gmail.com>
Date: Tue, 3 Apr 2018 21:16:44 +0000
Subject: [PATCH] Added security to the post template

Signed-off-by: Valentin Popov <valentineus@gmail.com>
---
 _layouts/post.html | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/_layouts/post.html b/_layouts/post.html
index 17e18f4..aa5b6ca 100644
--- a/_layouts/post.html
+++ b/_layouts/post.html
@@ -2,11 +2,17 @@
 layout: default
 ---
 
-<!-- Content of the post -->
 <div class="post">
-    <h1 class="post-title">{{ page.title }}</h1>
+    <!-- Header -->
+    <h1 class="post-title">
+        {{ page.title | smartify | strip_html | normalize_whitespace }}
+    </h1>
+
+    <!-- Date -->
     <span class="post-date">{{ page.date | date_to_long_string }}</span>
-    {{ content }}
+
+    <!-- Contents -->
+    {{ content | normalize_whitespace }}
 </div>
 
 <!-- Comments on the post -->
@@ -14,9 +20,9 @@ layout: default
     <div id="disqus_thread"></div>
     <script type="text/javascript" defer>
         var disqus_config = function() {
-            this.page.identifier = '{{ page.url | relative_url }}';
-            this.page.title = '{{ page.title }}';
-            this.page.url = '{{ page.url | absolute_url }}';
+            this.page.identifier = '{{ page.id | slugify }}';
+            this.page.title = '{{ page.title | smartify | strip_html | normalize_whitespace }}';
+            this.page.url = '{{ page.url | absolute_url | uri_escape }}';
         };
 
         (function() {