From: Thomas Tanghus <thomas@tanghus.net>
Date: Mon, 28 May 2012 12:38:31 +0000 (+0200)
Subject: Contacts: Fix XSS.
X-Git-Tag: v4.5.0beta1~74^2~428^2~2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=817f9ff57d127e4f3b4402c05a8628ff8ab6f513;p=nextcloud-server.git

Contacts: Fix XSS.
---

diff --git a/apps/contacts/js/contacts.js b/apps/contacts/js/contacts.js
index 256b5ad6d0a..34afdcc4e41 100644
--- a/apps/contacts/js/contacts.js
+++ b/apps/contacts/js/contacts.js
@@ -6,7 +6,7 @@ function ucwords (str) {
 
 String.prototype.strip_tags = function(){
 	tags = this;
-	stripped = tags.replace(/[\<\>]/gi, "");
+	stripped = tags.replace(/<(.|\n)*?>/g, '');
 	return stripped;
 };
 
@@ -159,7 +159,7 @@ Contacts={
 			
 			// Name has changed. Update it and reorder.
 			$('#fn').change(function(){
-				var name = $('#fn').val();
+				var name = $('#fn').val().strip_tags();
 				var item = $('#contacts [data-id="'+Contacts.UI.Card.id+'"]');
 				$(item).find('a').html(name);
 				var added = false;