escape log messages to avoid possible js execution

2012-06-18 09:42:31 +02:00 · 2012-06-18 09:42:31 +02:00 · 9d0cfacd67
parent d8048414aa
commit 9d0cfacd67
1 changed files with 1 additions and 1 deletions
--- a/settings/js/log.js
+++ b/settings/js/log.js
@ -39,7 +39,7 @@ OC.Log={
 			row.append(appTd);
 			
 			var messageTd=$('<td/>');
-			messageTd.text(entry.message);
+			messageTd.text(entry.message.replace(/</, "&lt;").replace(/>/, "&gt;"));
 			row.append(messageTd);
 			
 			var timeTd=$('<td/>');