diff options
| author | Max Fichtelmann <max.fichtelmann@procilon.de> | 2019-07-29 17:48:33 +0200 |
|---|---|---|
| committer | Backportbot <backportbot-noreply@rullzer.com> | 2019-07-30 07:53:24 +0000 |
| commit | cadd6fa92906768ee5d90ea5680deadb7284f8d6 (patch) | |
| tree | 0689612f4c4eb2c0db27d769c6057858740f4c71 /apps | |
| parent | 46a8af58c91ef2d95e99bd68cc6a30c77655e599 (diff) | |
| download | nextcloud-server-cadd6fa92906768ee5d90ea5680deadb7284f8d6.tar.gz nextcloud-server-cadd6fa92906768ee5d90ea5680deadb7284f8d6.zip | |
prevent potential XSS via unchecked use innerHTML
Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/theming/js/3rdparty/jscolor/jscolor.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/apps/theming/js/3rdparty/jscolor/jscolor.js b/apps/theming/js/3rdparty/jscolor/jscolor.js index 2bdd4607b41..cad36eab92a 100644 --- a/apps/theming/js/3rdparty/jscolor/jscolor.js +++ b/apps/theming/js/3rdparty/jscolor/jscolor.js @@ -1100,7 +1100,7 @@ var jsc = { if (jsc.isElementType(this.valueElement, 'input')) { this.valueElement.value = value; } else { - this.valueElement.innerHTML = value; + this.valueElement.innerHTML = _.escape(value); } } if (!(flags & jsc.leaveStyle)) { |