Properly escape html entities in debug

Fixes #276
node-red · Jul 17, 2014 · f80c410 · f80c410
1 parent 84a0e8c
commit f80c410
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/nodes/core/core/20-inject.html b/nodes/core/core/20-inject.html
@@ -400,7 +400,7 @@
         },
         button: {
             onclick: function() {
-                var label = (this.name||this.payload).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");
+                var label = (this.name||this.payload).replace(/&/g,"&amp;amp;").replace(/</g,"&amp;lt;").replace(/>/g,"&amp;gt;");
                 d3.xhr("inject/"+this.id).post(function(err,resp) {
                         if (err) {
                             if (err.status == 404) {

diff --git a/nodes/core/core/58-debug.html b/nodes/core/core/58-debug.html
@@ -150,9 +150,9 @@
                 }
 
             };
-            var name = (o.name?o.name:o.id).toString().replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");
-            var topic = (o.topic||"").toString().replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");
-            var payload = (o.msg||"").toString().replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");
+            var name = (o.name?o.name:o.id).toString().replace(/&/g,"&amp;amp;").replace(/</g,"&amp;lt;").replace(/>/g,"&amp;gt;");
+            var topic = (o.topic||"").toString().replace(/&/g,"&amp;amp;").replace(/</g,"&amp;lt;").replace(/>/g,"&amp;gt;");
+            var payload = (o.msg||"").toString().replace(/&/g,"&amp;amp;").replace(/</g,"&amp;lt;").replace(/>/g,"&amp;gt;");
             msg.className = 'debug-message'+(o.level?(' debug-message-level-'+o.level):'')
             msg.innerHTML = '<span class="debug-message-date">'+getTimestamp()+'</span>'+
                             '<span class="debug-message-name">['+name+']</span>'+