Escape file titles in recovery page

This commit is contained in:
benweet 2013-11-03 22:34:41 +00:00
parent d9b3b95f46
commit 81db48c1a9

View File

@ -42,6 +42,21 @@
elt.className = elt.className.replace(/ hide/, '');
}
var entityMap = {
"&": "&",
"<": "&lt;",
">": "&gt;",
'"': '&quot;',
"'": '&#39;',
"/": '&#x2F;'
};
function escapeHtml(string) {
return String(string).replace(/[&<>"'\/]/g, function(s) {
return entityMap[s];
});
}
function listFiles() {
// List files
var fileListElt = document.querySelector('.file-list');
@ -56,7 +71,7 @@
'<a href="javascript:removeFile(\'',
fileIndex,
'\')" class="icon-trash"></a> ',
fileTitle,
escapeHtml(fileTitle),
].join('');
fileListElt.appendChild(divElt);
}