Escape <> in log messages to prevent html shenanigans. Fixes #3596

ZoneMinder · Feb 18, 2023 · e1028c1 · e1028c1
1 parent 1546fab
commit e1028c1
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/web/skins/classic/views/js/log.js b/web/skins/classic/views/js/log.js
@@ -50,8 +50,8 @@ function ajaxRequest(params) {
 function processRows(rows) {
   $j.each(rows, function(ndx, row) {
     try {
-      row.Message = decodeURIComponent(row.Message);
-    } catch(e) {
+      row.Message = decodeURIComponent(row.Message).replace(/</g, "&lt;").replace(/>/g, "&gt;");
+    } catch (e) {
       // ignore errors
     }
   });