From 817f9ff57d127e4f3b4402c05a8628ff8ab6f513 Mon Sep 17 00:00:00 2001
From: Thomas Tanghus <thomas@tanghus.net>
Date: Mon, 28 May 2012 14:38:31 +0200
Subject: [PATCH] Contacts: Fix XSS.

---
 apps/contacts/js/contacts.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/contacts/js/contacts.js b/apps/contacts/js/contacts.js
index 256b5ad6d0a..34afdcc4e41 100644
--- a/apps/contacts/js/contacts.js
+++ b/apps/contacts/js/contacts.js
@@ -6,7 +6,7 @@ function ucwords (str) {
 
 String.prototype.strip_tags = function(){
 	tags = this;
-	stripped = tags.replace(/[\<\>]/gi, "");
+	stripped = tags.replace(/<(.|\n)*?>/g, '');
 	return stripped;
 };
 
@@ -159,7 +159,7 @@ Contacts={
 			
 			// Name has changed. Update it and reorder.
 			$('#fn').change(function(){
-				var name = $('#fn').val();
+				var name = $('#fn').val().strip_tags();
 				var item = $('#contacts [data-id="'+Contacts.UI.Card.id+'"]');
 				$(item).find('a').html(name);
 				var added = false;
-- 
2.39.5