More fixes for escaping subject information

horde · Mar 21, 2014 · b699c43 · b699c43
1 parent c880f39
commit b699c43
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/imp/js/dimpbase.js b/imp/js/dimpbase.js
@@ -509,7 +509,7 @@ var DimpBase = {
                         if (h == 'subject') {
                             /* This is an attribute, so we need to escape
                              * quotes only. */
-                            r.subjecttitle = r[h].gsub('"', '&quot;');
+                            r.subjecttitle = r[h].escapeHTML().gsub('"', '&quot;');
                         }
 
                         r[h] = r[h].escapeHTML();

diff --git a/imp/js/smartmobile.js b/imp/js/smartmobile.js
@@ -597,7 +597,7 @@ var ImpMobile = {
 
             list.append(
                 c.append(
-                    $('<a href="' + url + '"></a>').html(val.data.subject)).append(
+                    $('<a href="' + url + '"></a>').text(val.data.subject)).append(
                     $('<div class="imp-mailbox-secondrow"></div>').append(
                         $('<span class="imp-mailbox-date"></span>').text(
                             val.data.date)).append(