Add more escaping

Escape folder names in share.js
owncloud · Jul 4, 2016 · 6933d27 · 6933d27
1 parent 9d3cd61
commit 6933d27
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/js/vendor/owncloud/share.js b/js/vendor/owncloud/share.js
@@ -144,8 +144,8 @@
 			var data = this._loadShares(path);
 			var dropDownEl;
 			var self = this;
-			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="' + itemType +
-				'" data-item-source="' + path + '">';
+			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="' + escapeHTML(itemType) +
+				'" data-item-source="' + escapeHTML(path) + '">';
 			if (data !== false && data[0] && !_.isUndefined(data[0].uid_file_owner) &&
 				data[0].uid_file_owner !== OC.currentUser
 			) {