From 0bf34901f20575179f56d15dec07651d115d27e2 Mon Sep 17 00:00:00 2001
From: Vincent Petry <PVince81@yahoo.fr>
Date: Wed, 6 Jul 2016 14:58:05 +0200
Subject: [PATCH] More escaping in share dropdown

---
 js/share.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/share.js b/js/share.js
index 66b5ceac..5f9b0cde 100644
--- a/js/share.js
+++ b/js/share.js
@@ -296,7 +296,7 @@
 		showDropDown:function(itemType, itemSource, appendTo, link, possiblePermissions, filename) {
 			var data = OC.Share.loadItem(itemType, itemSource);
 			var dropDownEl;
-			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="'+itemType+'" data-item-source="'+itemSource+'">';
+			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="'+escapeHTML(itemType)+'" data-item-source="'+escapeHTML(itemSource)+'">';
 			if (data !== false && data.reshare !== false && data.reshare.uid_owner !== undefined && data.reshare.uid_owner !== OC.currentUser) {
 				html += '<span class="reshare">';
 				if (oc_config.enable_avatars === true) {