escape display name and email
This commit is contained in:
parent
1083085e6e
commit
78c0cc6089
|
@ -348,7 +348,7 @@ OC.Share={
|
|||
})
|
||||
.data("ui-autocomplete")._renderItem = function( ul, item ) {
|
||||
return $( "<li>" )
|
||||
.append( "<a>" + item.displayname + "<br>" + item.email + "</a>" )
|
||||
.append( "<a>" + escapeHTML(item.displayname) + "<br>" + escapeHTML(item.email) + "</a>" )
|
||||
.appendTo( ul );
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue