From a30040411c0068703b781099e64df2b299242117 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Fri, 18 Apr 2014 10:36:04 +0200
Subject: [PATCH] Backport of #7682 to stable6

---
 lib/private/eventsource.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/private/eventsource.php b/lib/private/eventsource.php
index a83084d9251..5080b8d066f 100644
--- a/lib/private/eventsource.php
+++ b/lib/private/eventsource.php
@@ -63,8 +63,9 @@ class OC_EventSource{
 			$type=null;
 		}
 		if($this->fallback) {
+			$fallBackId = OC_Util::sanitizeHTML($this->fallBackId);
 			$response='<script type="text/javascript">window.parent.OC.EventSource.fallBackCallBack('
-				.$this->fallBackId.',"'.$type.'",'.json_encode($data).')</script>'.PHP_EOL;
+				.$fallBackId.',"'.$type.'",'.json_encode($data).')</script>'.PHP_EOL;
 			echo $response;
 		}else{
 			if($type) {