Merge pull request #534 from V1RTUOZ/V1RTUOZ-patch-533

patch for #533

2 files changed, 14 insertions, 3 deletions

diff --git a/app/javascripts/common.js b/app/javascripts/common.js
index 58746044..8f58bfd4 100644
--- a/app/javascripts/common.js
+++ b/app/javascripts/common.js
@@ -894,6 +894,17 @@ var Common = (function () {
         }
 
     };
+    
+    /**
+     * Convert all applicable characters to HTML entities
+     * @public
+     * @param {string} cb
+     * @return {string}
+     */
+    self.htmlentities = function(s) {
+        return $('<div/>').text(s + '').html();
+    };
+
 
 
     /**
diff --git a/app/javascripts/dataform.js b/app/javascripts/dataform.js
index 74ac29d7..e8af85d2 100644
--- a/app/javascripts/dataform.js
+++ b/app/javascripts/dataform.js
@@ -591,8 +591,8 @@ var DataForm = (function () {
                                     '<div class="avatar-container">' +

                                         '<img class="avatar" src="' + './images/others/default-avatar.png' + '" alt="" />' +

                                     '</div>' +

-                                    '<div class="one-fn">' + bName + '</div>' +

-                                    '<div class="one-ctry">' + bCountry + '</div>' +

+                                    '<div class="one-fn">' + Common.htmlentities(bName) + '</div>' +

+                                    '<div class="one-ctry">' + Common.htmlentities(bCountry) + '</div>' +

                                     '<div class="one-jid">' + bXID + '</div>' +

                                     '<div class="buttons-container">';

 

@@ -1197,4 +1197,4 @@ var DataForm = (function () {
      */

     return self;

 

-})();
\ No newline at end of file
+})();