From 8e876081c9e2b96501e8da8625743d721e7f56f5 Mon Sep 17 00:00:00 2001
From: Jelmer Prins <jelmer@pageon.be>
Date: Wed, 23 Mar 2022 20:21:36 +0100
Subject: [PATCH] Fix xss bug in multiple select box

---
 src/Backend/Core/Js/jquery/jquery.backend.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Backend/Core/Js/jquery/jquery.backend.js b/src/Backend/Core/Js/jquery/jquery.backend.js
index cd03ae084a..e66ade3bc3 100644
--- a/src/Backend/Core/Js/jquery/jquery.backend.js
+++ b/src/Backend/Core/Js/jquery/jquery.backend.js
@@ -1043,7 +1043,7 @@
         '    <div class="input-group">' +
         '        <select size="1" class="form-control select dontSubmit" id="addValue-' + id + '" name="addValue-' + id + '">'
       for (var i = 0; i < possibleOptions.length; i++) {
-        html += '            <option value="' + $(possibleOptions[i]).attr('value') + '">' + $(possibleOptions[i]).html() + '</option>'
+        html += '            <option value="' + $('<div>').text($(possibleOptions[i]).attr('value')).html() + '">' + $(possibleOptions[i]).text() + '</option>'
       }
 
       html += '        </select>' +