Escape file titles in recovery page
This commit is contained in:
parent
d9b3b95f46
commit
81db48c1a9
@ -42,6 +42,21 @@
|
|||||||
elt.className = elt.className.replace(/ hide/, '');
|
elt.className = elt.className.replace(/ hide/, '');
|
||||||
}
|
}
|
||||||
|
|
||||||
|
var entityMap = {
|
||||||
|
"&": "&",
|
||||||
|
"<": "<",
|
||||||
|
">": ">",
|
||||||
|
'"': '"',
|
||||||
|
"'": ''',
|
||||||
|
"/": '/'
|
||||||
|
};
|
||||||
|
|
||||||
|
function escapeHtml(string) {
|
||||||
|
return String(string).replace(/[&<>"'\/]/g, function(s) {
|
||||||
|
return entityMap[s];
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
function listFiles() {
|
function listFiles() {
|
||||||
// List files
|
// List files
|
||||||
var fileListElt = document.querySelector('.file-list');
|
var fileListElt = document.querySelector('.file-list');
|
||||||
@ -56,7 +71,7 @@
|
|||||||
'<a href="javascript:removeFile(\'',
|
'<a href="javascript:removeFile(\'',
|
||||||
fileIndex,
|
fileIndex,
|
||||||
'\')" class="icon-trash"></a> ',
|
'\')" class="icon-trash"></a> ',
|
||||||
fileTitle,
|
escapeHtml(fileTitle),
|
||||||
].join('');
|
].join('');
|
||||||
fileListElt.appendChild(divElt);
|
fileListElt.appendChild(divElt);
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user