From: Lukas Reschke <lukas@statuscode.ch>
Date: Fri, 12 Oct 2012 12:08:06 +0000 (+0200)
Subject: Sanitize user input
X-Git-Tag: v5.0.0alpha1~799
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=e45f36c2d4161f59f9a87cc9b9c884e4600f42a8;p=nextcloud-server.git

Sanitize user input
---

diff --git a/apps/files_versions/js/versions.js b/apps/files_versions/js/versions.js
index 87396cd0ba1..07c5655560e 100644
--- a/apps/files_versions/js/versions.js
+++ b/apps/files_versions/js/versions.js
@@ -45,7 +45,7 @@ function createVersionsDropdown(filename, files) {
 
 	var historyUrl = OC.linkTo('files_versions', 'history.php') + '?path='+encodeURIComponent( $( '#dir' ).val() ).replace( /%2F/g, '/' )+'/'+encodeURIComponent( filename );
 
-	var html = '<div id="dropdown" class="drop drop-versions" data-file="'+files+'">';
+	var html = '<div id="dropdown" class="drop drop-versions" data-file="'+escapeHTML(files)+'">';
 	html += '<div id="private">';
 	html += '<select data-placeholder="Saved versions" id="found_versions" class="chzen-select" style="width:16em;">';
 	html += '<option value=""></option>';