diff --git a/script.html b/script.html index 69efac8..f06c3d9 100644 --- a/script.html +++ b/script.html @@ -279,15 +279,9 @@ function render(r) { ? r.quote.price_usd : Number(p.price_usd || 0); var head = '
' - // Built from a code point so no dollar sign sits against a quote in this - // file's patch text - that sequence is a substitution token to - // patch_git_file and once shipped a broken page (BROWSER_TESTS.md:265). - // The price as the server computes it NOW. price_usd is stamped on the row - // when the project is created, so it goes stale the moment the markup - // constant changes - which it just did, from 5x to actual cost. - var price = (r.quote && typeof r.quote.price_usd === 'number') - ? r.quote.price_usd : Number(p.price_usd || 0); - + // The currency sign is the HTML entity, never the character. A dollar sign + // next to a quote is a substitution token to patch_git_file, and a $ + // escape is no safer - it is decoded first and springs the same trap. + '
$' + Number(price).toFixed(2) + '
' + '
' + videoSecondsOf(p) + ' seconds · ' + (p.segments || 4) + ' shots' + (modelFor(p) ? ' · ' + esc(modelFor(p).label) : '') + '
'