diff options
| author | Max Fichtelmann <max.fichtelmann@procilon.de> | 2019-07-29 17:48:33 +0200 |
|---|---|---|
| committer | Backportbot <backportbot-noreply@rullzer.com> | 2019-07-30 07:54:06 +0000 |
| commit | f08798e91905febf0c9d66a7c0b48171959b896c (patch) | |
| tree | ca78c876fdb698e5c0c51a9295aef6683efd7a26 | |
| parent | 29504e8c8dd9a1876c00cdea430664b659f19298 (diff) | |
| download | nextcloud-server-f08798e91905febf0c9d66a7c0b48171959b896c.tar.gz nextcloud-server-f08798e91905febf0c9d66a7c0b48171959b896c.zip | |
prevent potential XSS via unchecked use innerHTML
Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>
| -rw-r--r-- | apps/theming/js/3rdparty/jscolor/jscolor.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/apps/theming/js/3rdparty/jscolor/jscolor.js b/apps/theming/js/3rdparty/jscolor/jscolor.js index 2bdd4607b41..cad36eab92a 100644 --- a/apps/theming/js/3rdparty/jscolor/jscolor.js +++ b/apps/theming/js/3rdparty/jscolor/jscolor.js @@ -1100,7 +1100,7 @@ var jsc = { if (jsc.isElementType(this.valueElement, 'input')) { this.valueElement.value = value; } else { - this.valueElement.innerHTML = value; + this.valueElement.innerHTML = _.escape(value); } } if (!(flags & jsc.leaveStyle)) { |