json_escape user input

fatfreecrm · Aug 26, 2014 · 9546449 · 9546449
1 parent 6369bf8
commit 9546449
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/views/layouts/application.html.haml b/app/views/layouts/application.html.haml
@@ -27,7 +27,7 @@
       :javascript
         #{yield :javascript}
         var _ffcrm_users = [
-        #{User.all.map{|u| "\"#{u.full_name} (@#{u.username})\"" }.join(",\n")}
+        #{User.all.map{|u| "\"#{j u.full_name} (@#{j u.username})\"" }.join(",\n")}
         ];
 
     <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">