prevent potential XSS via unchecked use innerHTML

Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>

diff --git a/apps/theming/js/3rdparty/jscolor/jscolor.js b/apps/theming/js/3rdparty/jscolor/jscolor.js
index 2bdd4607b41c77ced2c4a9fcd766426bd9dc1565..cad36eab92ab7b84a4991ceced081f40b0302ae7 100644 (file)
--- a/apps/theming/js/3rdparty/jscolor/jscolor.js
+++ b/apps/theming/js/3rdparty/jscolor/jscolor.js
@@ -1100,7 +1100,7 @@ var jsc = {
                                if (jsc.isElementType(this.valueElement, 'input')) {
                                        this.valueElement.value = value;
                                } else {
-                                       this.valueElement.innerHTML = value;
+                                       this.valueElement.innerHTML = _.escape(value);
                                }
                        }
                        if (!(flags & jsc.leaveStyle)) {