Merge pull request #244 from modoboa/fix/xss_issue_to_field

Fixed XSS issue in To field
modoboa · Feb 16, 2023 · 3b3b3b7 · 3b3b3b7
2 parents dd4ab50 + 8f4e51b
commit 3b3b3b7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modoboa_webmail/static/modoboa_webmail/js/webmail.js b/modoboa_webmail/static/modoboa_webmail/js/webmail.js
@@ -1138,7 +1138,7 @@ Webmail.prototype = {
         var renderFunc = function (item, escape) {
             if (item.display_name) {
                 return '<div>{0} {1}</div>'.format(
-                    item.display_name,
+                    htmlEncode(item.display_name),
                     escape('<{0}>'.format(item.address)));
             }
             return '<div>{0}</div>'.format(htmlEncode(item.address));