[Pkg-owncloud-commits] [owncloud] 138/223: Sanitize name of sharee

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch master
in repository owncloud.

commit 1066f4ec9a47a214e19f16d3fd11947c3c29643c
Author: Lukas Reschke <lukas at statuscode.ch>
Date:   Sat Jun 14 20:45:10 2014 +0200

    Sanitize name of sharee
    
    Fixes a XSS introduced with https://github.com/owncloud/core/commit/271684dcfec16122b88e03780b41af7120f27e45
---
 apps/files_sharing/js/share.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/files_sharing/js/share.js b/apps/files_sharing/js/share.js
index 47fe0bd..0999bfd 100644
--- a/apps/files_sharing/js/share.js
+++ b/apps/files_sharing/js/share.js
@@ -57,7 +57,7 @@
 									' data-action="Share-Notification" href="#" original-title="">' +
 									' <img class="svg" src="' + OC.imagePath('core', 'actions/share') + '"></img>';
 							$tr.find('.fileactions').append(function() {
-								var shareBy = t('files_sharing', 'Shared by {owner}', {owner: fileData.shareOwner});
+								var shareBy = t('files_sharing', 'Shared by {owner}', {owner: escapeHTML(fileData.shareOwner)});
 								var $result = $(shareNotification + '<span> ' + shareBy + '</span></span>');
 								$result.on('click', function() {
 									return false;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git