Merge pull request #8187 from owncloud/escape-more-character

Also encode > and '

diff --cc core/js/js.js
index cf35d8aac6a9af972807cf823904d51fc180759b,b712da4bd029dfb3bd744f197c3b833d61713add..21a2d4c1b35c5317e29bfb91625c17585cae7d0e
--- 1/core/js/js.js
--- 2/core/js/js.js
+++ b/core/js/js.js
@@@ -149,12 -146,12 +149,12 @@@ function n(app, text_singular, text_plu
  }
  
  /**
 -* Sanitizes a HTML string
 -* @param s string
 -* @return Sanitized string
 +* Sanitizes a HTML string by replacing all potential dangerous characters with HTML entities
 +* @param {string} s String to sanitize
 +* @return {string} Sanitized string
  */
  function escapeHTML(s) {
-       return s.toString().split('&').join('&amp;').split('<').join('&lt;').split('"').join('&quot;');
+       return s.toString().split('&').join('&amp;').split('<').join('&lt;').split('>').join('&gt;').split('"').join('&quot;').split('\'').join('&#039;');
  }
  
  /**

diff --cc core/js/tests/specs/coreSpec.js
Simple merge