Escape dropdown

Fixes #3241

diff --git a/core/js/share.js b/core/js/share.js
index 3a45178d277f1a248bacc412a509e4ca32c6447d..59d44880c2f8e91bb8e1ed629e11577071cb62c0 100644 (file)
--- a/core/js/share.js
+++ b/core/js/share.js
@@ -149,9 +149,9 @@ OC.Share={
                var html = '<div id="dropdown" class="drop" data-item-type="'+itemType+'" data-item-source="'+itemSource+'">';
                if (data !== false && data.reshare !== false && data.reshare.uid_owner !== undefined) {
                        if (data.reshare.share_type == OC.Share.SHARE_TYPE_GROUP) {
-                               html += '<span class="reshare">'+t('core', 'Shared with you and the group {group} by {owner}', {group: data.reshare.share_with, owner: data.reshare.displayname_owner})+'</span>';
+                               html += '<span class="reshare">'+t('core', 'Shared with you and the group {group} by {owner}', {group: escapeHTML(data.reshare.share_with), owner: escapeHTML(data.reshare.displayname_owner)})+'</span>';
                        } else {
-                               html += '<span class="reshare">'+t('core', 'Shared with you by {owner}', {owner: data.reshare.displayname_owner})+'</span>';
+                               html += '<span class="reshare">'+t('core', 'Shared with you by {owner}', {owner: escapeHTML(data.reshare.displayname_owner)})+'</span>';
                        }
                        html += '<br />';
                }