SONAR-4269 Fix XSS in configuration of dashboard

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/dashboard/configure.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/dashboard/configure.html.erb
index 310216edab045d790ee7d54a6bb8f317ca568910..9ffb899f05efea60f7fff68904e3c24eb9f4fdb2 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/dashboard/configure.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/dashboard/configure.html.erb
@@ -64,7 +64,7 @@
   function init_dashboard() {
     portal = new Portal(options);
   <% if params[:highlight] %>
-    portal.highlightWidget(<%= params[:highlight] -%>);
+    portal.highlightWidget(<%= escape_javascript(params[:highlight]) -%>);
   <% end %>
   }
   $j(document).ready(function(){init_dashboard();});