Merge pull request from GHSA-33g2-m556-gccr

glpi-project · May 31, 2022 · 9a3c748 · 9a3c748
1 parent fe57c6d
commit 9a3c748
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/js/modules/Kanban/Kanban.js b/js/modules/Kanban/Kanban.js
@@ -33,6 +33,7 @@
 
 import SearchInput from "../SearchTokenizer/SearchInput.js";
 
+/* global escapeMarkupText */
 /* global sortable */
 /* global glpi_toast_error */
 
@@ -2447,7 +2448,7 @@ class GLPIKanbanRights {
                     l.append(`
                      <div class="member-details">
                         ${member_item}
-                        ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}
+                        ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}
                      </div>
                      <button type="button" name="delete" class="btn btn-ghost-danger">
                         <i class="ti ti-x" title="${__('Delete')}"></i>