From 5816a34e643447ec3fd83cab2de735a9a06ca99e Mon Sep 17 00:00:00 2001
From: Flavio Copes <copesc@gmail.com>
Date: Sun, 17 Jan 2016 10:51:40 +0100
Subject: [PATCH] Escape user values in nav template

---
 themes/grav/templates/partials/nav.html.twig | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/themes/grav/templates/partials/nav.html.twig b/themes/grav/templates/partials/nav.html.twig
index 43065372..f93d9a08 100644
--- a/themes/grav/templates/partials/nav.html.twig
+++ b/themes/grav/templates/partials/nav.html.twig
@@ -9,12 +9,12 @@
 
     {#{% if admin.authorize %}#}
     <div id="admin-user-details">
-        <a href="{{ base_url_relative }}/users/{{ admin.user.username }}">
+        <a href="{{ base_url_relative }}/users/{{ admin.user.username|e }}">
             <img src="//www.gravatar.com/avatar/{{ admin.user.email|md5 }}?s=32" />
 
             <div class="admin-user-names">
-                <h4>{{ admin.user.fullname }}</h4>
-                <h5>{{ admin.user.title }}</h5>
+                <h4>{{ admin.user.fullname|e }}</h4>
+                <h5>{{ admin.user.title|e }}</h5>
             </div>
         </a>
     </div>