diff options
| author | Frank Karlitschek <frank@owncloud.org> | 2013-02-18 04:37:48 -0800 |
|---|---|---|
| committer | Frank Karlitschek <frank@owncloud.org> | 2013-02-18 04:37:48 -0800 |
| commit | 96ae110a2cbd8341aa175e4361cc8bc044bc6105 (patch) | |
| tree | e2d389099b9f3c35b001c1ce77f101e5573cc806 | |
| parent | 3b9796bfcce38e6e4138ffc68f5a2ff6e34492a0 (diff) | |
| parent | 79284b8e574a21fae21ca68b9863f3205200333a (diff) | |
| download | nextcloud-server-96ae110a2cbd8341aa175e4361cc8bc044bc6105.tar.gz nextcloud-server-96ae110a2cbd8341aa175e4361cc8bc044bc6105.zip | |
Merge pull request #1751 from owncloud/sanitizeHTML
Sanitize html
| -rw-r--r-- | apps/files_external/templates/settings.php | 2 | ||||
| -rw-r--r-- | settings/js/users.js | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/apps/files_external/templates/settings.php b/apps/files_external/templates/settings.php index d7a4dd5150d..3709fd2e51d 100644 --- a/apps/files_external/templates/settings.php +++ b/apps/files_external/templates/settings.php @@ -18,7 +18,7 @@ <?php foreach ($_['mounts'] as $mountPoint => $mount): ?> <tr <?php echo ($mountPoint != '') ? 'class="'.$mount['class'].'"' : 'id="addMountPoint"'; ?>> <td class="mountPoint"><input type="text" name="mountPoint" - value="<?php echo $mountPoint; ?>" + value="<?php p($mountPoint); ?>" placeholder="<?php echo $l->t('Mount point'); ?>" /></td> <?php if ($mountPoint == ''): ?> <td class="backend"> diff --git a/settings/js/users.js b/settings/js/users.js index 086b0884a3b..63a62049839 100644 --- a/settings/js/users.js +++ b/settings/js/users.js @@ -182,7 +182,7 @@ var UserList = { var addGroup = function (select, group) { $('select[multiple]').each(function (index, element) { if ($(element).find('option[value="' + group + '"]').length === 0 && select.data('msid') !== $(element).data('msid')) { - $(element).append('<option value="' + group + '">' + group + '</option>'); + $(element).append('<option value="' + escapeHTML(group) + '">' + escapeHTML(group) + '</option>'); } }) }; |