fix potential xss in multiselect

diff --git a/core/js/multiselect.js b/core/js/multiselect.js
index 541dddf0f708eb36d44562cdecac0f47dce0cc78..5f339006d268f28f4a6813bd0788bdefd2fe3b2a 100644 (file)
--- a/core/js/multiselect.js
+++ b/core/js/multiselect.js
@@ -57,8 +57,11 @@
                                element=$(element);
                                var item=element.val();
                                var id='ms'+multiSelectId+'-option-'+item;
-                               var input=$('<input id="'+id+'" type="checkbox"/>');
-                               var label=$('<label for="'+id+'">'+item+'</label>');
+                               var input=$('<input type="checkbox"/>');
+                               input.attr('id',id);
+                               var label=$('<label/>');
+                               label.attr('for',id);
+                               label.text(item);
                                if(settings.checked.indexOf(item)!=-1 || checked){
                                        input.attr('checked',true);
                                }
@@ -130,7 +133,10 @@
                                                        li.text('+ '+settings.createText);
                                                        li.before(createItem(this));
                                                        var select=button.parent().next();
-                                                       select.append($('<option selected="selected" value="'+$(this).val()+'">'+$(this).val()+'</option>'));
+                                                       var option=$('<option selected="selected"/>');
+                                                       option.attr('value',$(this).val());
+                                                       option.text($(this).val());
+                                                       select.append(optione);
                                                        li.prev().children('input').trigger('click');
                                                        button.parent().data('preventHide',false);
                                                        if(settings.createCallback){