Escape <> in log messages to prevent html shenanigans. Fixes #3596

2022-10-21 16:21:25 -04:00 · 2022-10-21 16:21:25 -04:00 · 3d68896625
parent 42e8698318
commit 3d68896625
1 changed files with 1 additions and 1 deletions
--- a/web/skins/classic/views/js/log.js
+++ b/web/skins/classic/views/js/log.js
@ -50,7 +50,7 @@ function ajaxRequest(params) {
 function processRows(rows) {
  $j.each(rows, function(ndx, row) {
    try {
-      row.Message = decodeURIComponent(row.Message);
+      row.Message = decodeURIComponent(row.Message).replace(/</g, "&lt;").replace(/>/g, "&gt;");
    } catch (e) {
      // ignore errors
    }