escape html

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
nextcloud · Oct 16, 2023 · c71c5c4 · c71c5c4
1 parent 7cef628
commit c71c5c4
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/js/files/circles.files.list.js b/js/files/circles.files.list.js
@@ -124,11 +124,20 @@
 					},
 
 					formatResult: function(circle) {
-						return circle.name;
+						return this.escapeHTML(circle.name);
 					},
 
 					formatSelection: function(circle) {
-						return circle.name;
+						return this.escapeHTML(circle.name);
+					},
+
+					escapeHTML: function (text) {
+						return text.toString()
+							.split('&').join('&amp;')
+							.split('<').join('&lt;')
+							.split('>').join('&gt;')
+							.split('"').join('&quot;')
+							.split('\'').join('&#039;');
 					},
 
 					sortResults: function(results) {