From: Seamus Lee <seamuslee001@gmail.com>
Date: Wed, 15 Jul 2020 03:00:33 +0000 (+1000)
Subject: security/core#94 Escape subject content when loading the Activity list for a contact
X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=f44de3a4dc6d5b7bb40ed478d97f47665570f689;p=civicrm-core.git

security/core#94 Escape subject content when loading the Activity list for a contact
---

diff --git a/templates/CRM/Activity/Selector/Selector.tpl b/templates/CRM/Activity/Selector/Selector.tpl
index ffb235266b..4817467ee5 100644
--- a/templates/CRM/Activity/Selector/Selector.tpl
+++ b/templates/CRM/Activity/Selector/Selector.tpl
@@ -50,7 +50,7 @@
 
   {literal}
     <script type="text/javascript">
-      (function($) {
+      (function($, _) {
         var context = {/literal}"{$context}"{literal};
         CRM.$('table.contact-activity-selector-' + context).data({
           "ajax": {
@@ -67,11 +67,16 @@
           }
         });
         $(function($) {
+          $('table.contact-activity-selector-' + context).on('xhr.dt', function(e, settings, json, xhr) {
+            for (var i=0, ien=json.data.length; i<ien; i++) {
+              json.data[i].subject = _.escape(json.data[i].subject);
+            }
+          });
           $('.activity-search-options :input').change(function(){
-            CRM.$('table.contact-activity-selector-' + context).DataTable().draw();
+            $('table.contact-activity-selector-' + context).DataTable().draw();
           });
         });
-      })(CRM.$);
+      })(CRM.$, CRM._);
     </script>
   {/literal}
   <style type="text/css">