escape log messages to avoid possible js execution

13 years ago · 91f69858e4
parent e5feb4e1aa
commit 91f69858e4
1 changed files with 1 additions and 1 deletions
--- a/settings/js/log.js
+++ b/settings/js/log.js
@ -39,7 +39,7 @@ OC.Log={
 			row.append(appTd);
 			
 			var messageTd=$('<td/>');
-			messageTd.text(entry.message);
+			messageTd.text(entry.message.replace(/</, "&lt;").replace(/>/, "&gt;"));
 			row.append(messageTd);
 			
 			var timeTd=$('<td/>');