From 1066f4ec9a47a214e19f16d3fd11947c3c29643c Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Sat, 14 Jun 2014 20:45:10 +0200
Subject: [PATCH 1/2] Sanitize name of sharee

Fixes a XSS introduced with https://github.com/owncloud/core/commit/271684dcfec16122b88e03780b41af7120f27e45
---
 apps/files_sharing/js/share.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/files_sharing/js/share.js b/apps/files_sharing/js/share.js
index 47fe0bd2c5..0999bfd6be 100644
--- a/apps/files_sharing/js/share.js
+++ b/apps/files_sharing/js/share.js
@@ -57,7 +57,7 @@
 									' data-action="Share-Notification" href="#" original-title="">' +
 									' <img class="svg" src="' + OC.imagePath('core', 'actions/share') + '"></img>';
 							$tr.find('.fileactions').append(function() {
-								var shareBy = t('files_sharing', 'Shared by {owner}', {owner: fileData.shareOwner});
+								var shareBy = t('files_sharing', 'Shared by {owner}', {owner: escapeHTML(fileData.shareOwner)});
 								var $result = $(shareNotification + '<span> ' + shareBy + '</span></span>');
 								$result.on('click', function() {
 									return false;

From 35740cf9412c92b649db97a0cf7549f740dcbd27 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Sat, 14 Jun 2014 20:56:54 +0200
Subject: [PATCH 2/2] Do even more sanitization

---
 core/js/share.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/js/share.js b/core/js/share.js
index dc808c295b..e164602d0a 100644
--- a/core/js/share.js
+++ b/core/js/share.js
@@ -199,10 +199,10 @@ OC.Share={
 			message = t('core', 'Shared');
 			// even if reshared, only show "Shared by"
 			if (owner) {
-				message = t('files_sharing', 'Shared by {owner}', {owner: owner});
+				message = t('files_sharing', 'Shared by {owner}', {owner: escapeHTML(owner)});
 			}
 			else if (recipients) {
-				message = t('core', 'Shared with {recipients}', {recipients: recipients});
+				message = t('core', 'Shared with {recipients}', {recipients: escapeHTML(recipients)});
 			}
 			action.html(' <span>'+ message + '</span>').prepend(img);
 		}
@@ -337,9 +337,9 @@ OC.Share={
 				var defaultExpireMessage = '';
 				if ((itemType === 'folder' || itemType === 'file') && oc_appconfig.core.defaultExpireDateEnabled) {
 					if (oc_appconfig.core.defaultExpireDateEnforced) {
-						defaultExpireMessage = t('core', 'The public link will expire no later than {days} days after it is created',  {'days': oc_appconfig.core.defaultExpireDate}) + '<br/>';
+						defaultExpireMessage = t('core', 'The public link will expire no later than {days} days after it is created',  {'days': escapeHTML(oc_appconfig.core.defaultExpireDate)}) + '<br/>';
 					} else {
-						defaultExpireMessage = t('core', 'By default the public link will expire after {days} days', {'days': oc_appconfig.core.defaultExpireDate}) + '<br/>';
+						defaultExpireMessage = t('core', 'By default the public link will expire after {days} days', {'days': escapeHTML(oc_appconfig.core.defaultExpireDate)}) + '<br/>';
 					}
 				}
 
@@ -537,7 +537,7 @@ OC.Share={
 			if (collectionList.length > 0) {
 				$(collectionList).append(', '+shareWithDisplayName);
 			} else {
-				var html = '<li style="clear: both;" data-collection="'+item+'">'+t('core', 'Shared in {item} with {user}', {'item': item, user: shareWithDisplayName})+'</li>';
+				var html = '<li style="clear: both;" data-collection="'+item+'">'+t('core', 'Shared in {item} with {user}', {'item': escapeHTML(item), user: escapeHTML(shareWithDisplayName)})+'</li>';
 				$('#shareWithList').prepend(html);
 			}
 		} else {