escape log messages to avoid possible js execution

14 years ago · 9d0cfacd67
parent d8048414aa
commit 9d0cfacd67
1 changed files with 1 additions and 1 deletions
--- a/settings/js/log.js
+++ b/settings/js/log.js
@ -39,7 +39,7 @@ OC.Log={
 			row.append(appTd);
 			
 			var messageTd=$('<td/>');
-			messageTd.text(entry.message);
+			messageTd.text(entry.message.replace(/</, "&lt;").replace(/>/, "&gt;"));
 			row.append(messageTd);
 			
 			var timeTd=$('<td/>');