From bd52a85f98c321543fc1ad0bd06863efd19c7e89 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Sun, 30 Aug 2009 21:34:55 -0700
Subject: (mostly harmless) XSS fix in server add

---
 modules/server_add/views/server_add_tree.html.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'modules')

diff --git a/modules/server_add/views/server_add_tree.html.php b/modules/server_add/views/server_add_tree.html.php
index dbae42c5..def37b74 100644
--- a/modules/server_add/views/server_add_tree.html.php
+++ b/modules/server_add/views/server_add_tree.html.php
@@ -9,7 +9,7 @@
     <? foreach ($parents as $dir): ?>
     <li class="ui-icon-left">
       <span class="ui-icon ui-icon-folder-open"></span>
-      <span ondblclick="open_dir('<?= $dir ?>')">
+      <span ondblclick="open_dir(<?= html::js_string($dir) ?>)">
         <?= html::clean(basename($dir)) ?>
       </span>
       <ul>
@@ -22,7 +22,7 @@
                 <? if (is_dir($file)): ?>
                 ondblclick="open_dir($(this).attr('file'))"
                 <? endif ?>
-                file="<?= strtr($file, array('"' => '\\"')) ?>"
+                file="<?= html::clean_attribute($file) ?>"
                 >
             <?= html::clean(basename($file)) ?>
           </span>
-- 
cgit v1.2.3