Merge pull request #8526 from owncloud/escape-share-emails-master

escape display name and email

core/js/share.js

@@ -347,8 +347,8 @@ OC.Share={
 					}
 				})
 				.data("ui-autocomplete")._renderItem = function( ul, item ) {
-					return $( "<li>" )
-						.append( "<a>" + item.displayname + "<br>" + item.email + "</a>" )
+					return $('<li>')
+						.append('<a>' + escapeHTML(item.displayname) + "<br>" + escapeHTML(item.email) + '</a>' )
 						.appendTo( ul );
 				};
 			}