properly escape user names and list names

2012-02-22 10:14:07 +00:00 · 2012-02-22 10:14:07 +00:00 · 13eec9346b
commit 13eec9346b
parent 4610811821
12 changed files with 68 additions and 21 deletions
--- a/static/js/pandora/account.js
+++ b/static/js/pandora/account.js
@ -379,7 +379,10 @@ pandora.ui.accountWelcomeDialog = function() {
                .append(
                    Ox.Element()
                        .css({position: 'absolute', left: '96px', top: '16px', width: '192px'})
-                        .html('Welcome, ' + pandora.user.username + '!<br/><br/>Your account has been created.')
+                        .html(
+                            'Welcome, ' + Ox.encodeHTMLEntities(pandora.user.username)
+                            + '!<br/><br/>Your account has been created.'
+                        )
                ),
            fixedSize: true,
            height: 128,