diff options
| author | Jen-Shin Lin <jen-shin@gitlab.com> | 2017-10-17 13:12:24 +0300 |
|---|---|---|
| committer | Jen-Shin Lin <jen-shin@gitlab.com> | 2017-10-17 13:12:24 +0300 |
| commit | 16b24606e7ae94c32c51e93aad93a9e4dd485f26 (patch) | |
| tree | 2cf22ad1fb8b5efe0e35f8d4423a6681dc77d1a6 /app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js | |
| parent | ff3e5fa26d8506c571274b308881481fa552c20b (diff) | |
| parent | 02fc18b5cc6223a129d6f6af1e8037736ce94462 (diff) | |
Merge branch 'security-10-1' into '10-1-stable'
Security fixes for 10.1 RC
See merge request gitlab/gitlabhq!2209
Diffstat (limited to 'app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js')
| -rw-r--r-- | app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js b/app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js index 28e8240169d..55c153a6d46 100644 --- a/app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js +++ b/app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js @@ -123,8 +123,8 @@ class FilteredSearchVisualTokens { /* eslint-disable no-param-reassign */ tokenValueContainer.dataset.originalValue = tokenValue; tokenValueElement.innerHTML = ` - <img class="avatar s20" src="${user.avatar_url}" alt="${user.name}'s avatar"> - ${user.name} + <img class="avatar s20" src="${user.avatar_url}" alt=""> + ${_.escape(user.name)} `; /* eslint-enable no-param-reassign */ }) |