Fix xss vulnerability

Dmitriy Zaporozhets
1 parent 1665a06f
Showing 1 changed file with 1 additions and 1 deletions Show diff stats
app/views/search/show.html.haml
@@ -88,5 +88,5 @@
                   %h4.nothing_here_message No wiki pages
   :javascript
     $(function() {
-      $(".search_results .term").highlight("#{params[:search]}");
+      $(".search_results .term").highlight("#{escape_javascript(params[:search])}");
     })
	@@ -88,5 +88,5 @@		@@ -88,5 +88,5 @@
88	%h4.nothing_here_message No wiki pages	88	%h4.nothing_here_message No wiki pages
89	:javascript	89	:javascript
90	$(function() {	90	$(function() {
91	- $(".search_results .term").highlight("#{params[:search]}");	91	+ $(".search_results .term").highlight("#{escape_javascript(params[:search])}");
92	})	92	})