From: Robin Appelman <icewind@owncloud.com>
Date: Sat, 9 Jun 2012 13:07:09 +0000 (+0200)
Subject: fix potential xss in multiselect
X-Git-Tag: v4.5.0beta1~74^2~422^2~21
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=cfe219fbb9f2f734b063041ae420400044f90000;p=nextcloud-server.git

fix potential xss in multiselect
---

diff --git a/core/js/multiselect.js b/core/js/multiselect.js
index 541dddf0f70..5f339006d26 100644
--- a/core/js/multiselect.js
+++ b/core/js/multiselect.js
@@ -57,8 +57,11 @@
 				element=$(element);
 				var item=element.val();
 				var id='ms'+multiSelectId+'-option-'+item;
-				var input=$('<input id="'+id+'" type="checkbox"/>');
-				var label=$('<label for="'+id+'">'+item+'</label>');
+				var input=$('<input type="checkbox"/>');
+				input.attr('id',id);
+				var label=$('<label/>');
+				label.attr('for',id);
+				label.text(item);
 				if(settings.checked.indexOf(item)!=-1 || checked){
 					input.attr('checked',true);
 				}
@@ -130,7 +133,10 @@
 							li.text('+ '+settings.createText);
 							li.before(createItem(this));
 							var select=button.parent().next();
-							select.append($('<option selected="selected" value="'+$(this).val()+'">'+$(this).val()+'</option>'));
+							var option=$('<option selected="selected"/>');
+							option.attr('value',$(this).val());
+							option.text($(this).val());
+							select.append(optione);
 							li.prev().children('input').trigger('click');
 							button.parent().data('preventHide',false);
 							if(settings.createCallback){