diff options
| author | Tom Needham <needham.thomas@gmail.com> | 2015-09-03 00:28:55 +0300 |
|---|---|---|
| committer | Joas Schilling <nickvergessen@owncloud.com> | 2015-09-14 16:50:24 +0300 |
| commit | 8812108b5833fbca3c7ee698913b153fca1c541e (patch) | |
| tree | 2d24160ca2c15f70be24d0f63e6597508abfbbea /js/notification.js | |
| parent | 53ff980f91a2889360aebc601f5d919ba5e1b45a (diff) | |
Sanitize output in JS
Diffstat (limited to 'js/notification.js')
| -rw-r--r-- | js/notification.js | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/js/notification.js b/js/notification.js index 200d753..b9703c9 100644 --- a/js/notification.js +++ b/js/notification.js @@ -81,7 +81,7 @@ }, getEl: function() { - return $('div.notification[data-id='+this.getId()+']'); + return $('div.notification[data-id='+escapeHTML(this.getId())+']'); }, getApp: function() { @@ -93,15 +93,15 @@ */ renderElement: function() { var el = $('<div class="notification"></div>'); - el.attr('data-id', this.getId()); - el.attr('data-timestamp', this.getTimestamp()); - el.append('<div class="notification-app">'+this.getApp()+'</div><div class="notification-subject">> '+this.getSubject()+'</div>'); - el.append('<div class="notification-message">'+this.getMessage()+'</div>'); + el.attr('data-id', escapeHTML(this.getId())); + el.attr('data-timestamp', escapeHTML(this.getTimestamp())); + el.append('<div class="notification-app">'+escapeHTML(this.getApp())+'</div><div class="notification-subject">> '+escapeHTML(this.getSubject())+'</div>'); + el.append('<div class="notification-message">'+escapeHTML(this.getMessage())+'</div>'); // Add actions var actions = $('<div class="actions"></div>'); var actionsData = this.getActions(); $.each(actionsData, function(index) { - actions.append('<div class="button"><a href="'+actionsData[index].link+'">'+actionsData[index].label+'</a></div>'); + actions.append('<div class="button"><a href="'+escapeHTML(actionsData[index].link)+'">'+escapeHTML(actionsData[index].label)+'</a></div>'); // TODO create event handler on click for given action type }); el.append(actions); |