commit 5be2239

Quick fix to "Script self-injection in edit box".

In the 'Edit...' box, the sourceContent (which was written by a user)
has its < replaced with &lt; . This issue does not propagate to the
public timeline nor to the recipients of the post.

Reference: https://codeberg.org/grunfink/snac2/issues/53

 1@@ -668,9 +668,11 @@ xs_str *html_entry_controls(snac *snac, xs_str *os, const xs_dict *msg, const ch
 2 
 3     s = xs_str_cat(s, "</form>\n");
 4 
 5-    char *prev_src = xs_dict_get(msg, "sourceContent");
 6+    const char *prev_src1 = xs_dict_get(msg, "sourceContent");
 7+
 8+    if (!xs_is_null(prev_src1) && strcmp(actor, snac->actor) == 0) {
 9+        xs *prev_src = xs_replace(prev_src1, "<", "&lt;");
10 
11-    if (!xs_is_null(prev_src) && strcmp(actor, snac->actor) == 0) {
12         /* post can be edited */
13         xs *s1 = xs_fmt(
14             "<p><details><summary>%s</summary>\n"