Merge pull request #647 from owncloud/stable9-share-escape

[stable9] More escaping in share dropdown
owncloud-archive · Aug 9, 2016 · 22175f5 · 22175f5
2 parents cb7559b + 0bf3490
commit 22175f5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/js/share.js b/js/share.js
@@ -296,7 +296,7 @@
 		showDropDown:function(itemType, itemSource, appendTo, link, possiblePermissions, filename) {
 			var data = OC.Share.loadItem(itemType, itemSource);
 			var dropDownEl;
-			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="'+itemType+'" data-item-source="'+itemSource+'">';
+			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="'+escapeHTML(itemType)+'" data-item-source="'+escapeHTML(itemSource)+'">';
 			if (data !== false && data.reshare !== false && data.reshare.uid_owner !== undefined && data.reshare.uid_owner !== OC.currentUser) {
 				html += '<span class="reshare">';
 				if (oc_config.enable_avatars === true) {