Sanitize name of sharee

Fixes a XSS introduced with https://github.com/owncloud/core/commit/271684dcfec16122b88e03780b41af7120f27e45

diff --git a/apps/files_sharing/js/share.js b/apps/files_sharing/js/share.js
index 47fe0bd2c571304508df9d8abd457c7dfa599379..0999bfd6bed5e51e73cf921ed181f083724b05b2 100644 (file)
--- a/apps/files_sharing/js/share.js
+++ b/apps/files_sharing/js/share.js
@@ -57,7 +57,7 @@
                                                                        ' data-action="Share-Notification" href="#" original-title="">' +
                                                                        ' <img class="svg" src="' + OC.imagePath('core', 'actions/share') + '"></img>';
                                                        $tr.find('.fileactions').append(function() {
-                                                               var shareBy = t('files_sharing', 'Shared by {owner}', {owner: fileData.shareOwner});
+                                                               var shareBy = t('files_sharing', 'Shared by {owner}', {owner: escapeHTML(fileData.shareOwner)});
                                                                var $result = $(shareNotification + '<span> ' + shareBy + '</span></span>');
                                                                $result.on('click', function() {
                                                                        return false;