From 4977f235f60a4ae4257f79b7d96d3cf109850072 Mon Sep 17 00:00:00 2001
From: Max Fichtelmann <max.fichtelmann@procilon.de>
Date: Mon, 29 Jul 2019 17:48:33 +0200
Subject: prevent potential XSS via unchecked use innerHTML

Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>
---
 apps/theming/js/3rdparty/jscolor/jscolor.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'apps/theming/js')

diff --git a/apps/theming/js/3rdparty/jscolor/jscolor.js b/apps/theming/js/3rdparty/jscolor/jscolor.js
index 2bdd4607b41..cad36eab92a 100644
--- a/apps/theming/js/3rdparty/jscolor/jscolor.js
+++ b/apps/theming/js/3rdparty/jscolor/jscolor.js
@@ -1100,7 +1100,7 @@ var jsc = {
 				if (jsc.isElementType(this.valueElement, 'input')) {
 					this.valueElement.value = value;
 				} else {
-					this.valueElement.innerHTML = value;
+					this.valueElement.innerHTML = _.escape(value);
 				}
 			}
 			if (!(flags & jsc.leaveStyle)) {
-- 
cgit v1.2.3