Don't concatenate tainted strings in JS. Fixes #1976.

1 files changed, 5 insertions, 1 deletions

diff --git a/modules/gallery/js/l10n_client.js b/modules/gallery/js/l10n_client.js
index a1b970e7..6d919c29 100644
--- a/modules/gallery/js/l10n_client.js
+++ b/modules/gallery/js/l10n_client.js
@@ -140,7 +140,11 @@ jQuery.extend(Gallery, {
       } else {
         if(search.length > 0) {
           $('#l10n-client-string-select li').hide();
-          $('#l10n-client-string-select li:contains('+search+')').show();
+          $('#l10n-client-string-select li').each(function() {
+            if ($(this).val().indexOf(search) != -1) {
+		$(this).show();
+	    }
+          });
           $('#l10n-client #g-l10n-search').val(search);
         }
       }