Make sure series names and metric names are escaped before being displayed in evolution graph tooltips.

1 files changed, 4 insertions, 2 deletions

diff --git a/plugins/CoreVisualizations/javascripts/jqplotEvolutionGraph.js b/plugins/CoreVisualizations/javascripts/jqplotEvolutionGraph.js
index fbcb55d03e..3b62e9197e 100644
--- a/plugins/CoreVisualizations/javascripts/jqplotEvolutionGraph.js
+++ b/plugins/CoreVisualizations/javascripts/jqplotEvolutionGraph.js
@@ -135,12 +135,14 @@
                     for (var d = 0; d < self.data.length; d++) {
                         var value = self.formatY(self.data[d][tick], d);
                         var series = self.jqplotParams.series[d].label;
-                        text.push('<strong>' + value + '</strong> ' + series);
+                        text.push('<strong>' + value + '</strong> ' + piwikHelper.htmlEntities(series));
                     }
+                    var content = '<h3>'+piwikHelper.htmlEntities(label)+'</h3>'+text.join('<br />');
+
                     $(this).tooltip({
                         track:   true,
                         items:   'div',
-                        content: '<h3>'+label+'</h3>'+text.join('<br />'),
+                        content: content,
                         show: false,
                         hide: false
                     }).trigger('mouseover');