SECURITY: XSS in search results term

Thanks to Jerbi Nessim
2015-10-07 10:52:24 +11:00 · 2015-10-07 10:52:24 +11:00 · 845c33e4b1
parent 81a48af1a3
commit 845c33e4b1
1 changed files with 1 additions and 1 deletions
--- a/app/assets/javascripts/discourse/controllers/full-page-search.js.es6
+++ b/app/assets/javascripts/discourse/controllers/full-page-search.js.es6
@ -75,7 +75,7 @@ export default Ember.Controller.extend({
        }
      });
    }
-    return q;
+    return Handlebars.Utils.escapeExpression(q);
  },
  _searchOnSortChange: true,