From a14f5d08c264637639d518267a1397e137823fcf Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Mon, 10 Nov 2025 22:31:03 -0800
Subject: Validate the QR code

Since the qr code is generated by a 3rd party dependency that I probably
won't update, let's make sure to only pass it trusted input.
---
 templates/wormhole.html.template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'templates/wormhole.html.template')

diff --git a/templates/wormhole.html.template b/templates/wormhole.html.template
index ad23b57..eb423ca 100644
--- a/templates/wormhole.html.template
+++ b/templates/wormhole.html.template
@@ -12,7 +12,7 @@
 		</li>
 		<li>
 			<p>Visit this URL <a href="/wormhole/{{.Hole}}">{{.Self}}/wormhole/{{.Hole}}</a> or scan QR code:</p>
-			<img src="/wormhole/{{.Hole}}/qr.png" alt="QR code for {{.Self}}/wormhole/{{.Hole}}">
+			<img src="/wormhole/{{.Hole}}/qr.png?s={{.Sig}}" alt="QR code for {{.Self}}/wormhole/{{.Hole}}">
 		</li>
 		<li>
 			<label for="submit">Click here:</label>
-- 
cgit v1.3.1