escape customer, project and activity name in javascript (#2959)

2021-11-19 19:45:37 +01:00
parent 859131308a
commit 89bfa82c61
7 changed files with 23 additions and 7 deletions
--- a/assets/js/plugins/KimaiRecentActivities.js
+++ b/assets/js/plugins/KimaiRecentActivities.js
@@ -65,9 +65,10 @@ export default class KimaiRecentActivities extends KimaiPlugin {

        for (let timesheet of entries) {
            let label = this.attributes['template']
-                .replace('%customer%', timesheet.project.customer.name)
-                .replace('%project%', timesheet.project.name)
-                .replace('%activity%', timesheet.activity.name);
+                .replace('%customer%', this.escape(timesheet.project.customer.name))
+                .replace('%project%', this.escape(timesheet.project.name))
+                .replace('%activity%', this.escape(timesheet.activity.name))
+            ;

            htmlToInsert +=
                `<li>` +