From f62bba6513ec840761f2434b93168106c7c65a3d Mon Sep 17 00:00:00 2001
From: Lorenzo Miniero <lminiero@gmail.com>
Date: Wed, 15 Dec 2021 14:10:01 +0100
Subject: [PATCH] Fixed missing XSS mitigation (see #2817)

---
 html/textroomtest.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/html/textroomtest.js b/html/textroomtest.js
index bf95a260a7..7d5ae832ca 100644
--- a/html/textroomtest.js
+++ b/html/textroomtest.js
@@ -351,7 +351,7 @@ function sendPrivateMsg(username) {
 				text: JSON.stringify(message),
 				error: function(reason) { bootbox.alert(reason); },
 				success: function() {
-					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result);
+					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result));
 					$('#chatroom').get(0).scrollTop = $('#chatroom').get(0).scrollHeight;
 				}
 			});