Fix security vulnerability

base.inc

@@ -50,7 +50,7 @@
 		</header>
 		<main>{% content() %}</main>
 		<footer>
-			<p>Running Ikibooru v0.1</p>
+			<p>Running <a href="https://mid.net.ua/ikibooru.html">Ikibooru</a> v0.0.0.1</p>
 		</footer>
 		<script defer src="/static/datetimes.js"></script>
 	</body>

core.lua

@@ -192,9 +192,9 @@ local handler = function(req, res)
 		
 		local succ, val
 		if _ENV then
-			succ, val = xpcall(Lyre.render, debug.traceback, tmpl, env)
+			succ, val = xpcall(Lyre.render, debug.traceback, tmpl, env, true)
 		else
-			succ, val = pcall(Lyre.render, tmpl, env)
+			succ, val = pcall(Lyre.render, tmpl, env, true)
 		end
 		
 		if succ then

index.html.l

@@ -67,16 +67,25 @@
 				var box = document.getElementById("alltags")
 				var datags = []
 				ajax.responseText.split("\n").slice(0, -1).forEach(function(line) {
+					var tagID = line.split(",")[0]
+					
 					var newtag = document.createElement("div")
 					newtag.classList.toggle("tag")
 					newtag.classList.toggle("tc" + line.split(",")[2])
-					newtag.setAttribute("data-tagid", line.split(",")[0])
+					newtag.setAttribute("data-tagid", tagID)
 					newtag.setAttribute("data-tc", line.split(",")[2])
 					newtag.innerText = line.split(",")[1]
+					
 					datags.push(newtag)
 				})
 				datags.sort(function(a, b) {return a.getAttribute("data-tc") - b.getAttribute("data-tc")})
-				datags.forEach(function(x) { box.insertBefore(x, null) })
+				datags.forEach(function(x) {
+					var newa = document.createElement("a")
+					newa.setAttribute("href", "/search?n=&t=" + x.getAttribute("data-tagid") + "&h");
+					newa.appendChild(x);
+					
+					box.insertBefore(newa, null)
+				})
 			}
 		}
 		ajax.send()

obj.html.l

@@ -55,7 +55,7 @@
 			</ul>
 			<div>
 				{% for _,tag in pairs(DB.getobjtags(obj.id)) do %}
-					<div class="tag tc{{ tag.category }}" data-tagid="{{ tag.id }}">{{ Escapes.htmlescape(tag.name) }}</div>
+					<a href="/search?n=&t={{ tag.id }}&o"><div class="tag tc{{ tag.category }}" data-tagid="{{ tag.id }}">{{ Escapes.htmlescape(tag.name) }}</div></a>
 				{% end %}
 			</div>
 			{% if verified and verified.privs >= DB.USER_PRIVS_APPROVED then %}

static/style.css

@@ -22,6 +22,7 @@ div.tag {
 	border: 1px solid blue;
 	padding: 0.1em;
 	margin: 0.1em;
+	color: black;
 }
 div.tag.selected {
 	border-width: 2px;