Correctly escape user names in vhost list and vice versa.

2015-01-05 13:39:09 +00:00 · 2015-01-05 13:39:09 +00:00 · 271a5f6d3c
parent 68b4686705
commit 271a5f6d3c
1 changed files with 1 additions and 1 deletions
--- a/deps/rabbitmq_management/priv/www/js/formatters.js
+++ b/deps/rabbitmq_management/priv/www/js/formatters.js
@ -777,7 +777,7 @@ function fmt_permissions(obj, permissions, lookup, show, warning) {
    for (var i in permissions) {
        var permission = permissions[i];
        if (permission[lookup] == obj.name) {
-            res.push(permission[show]);
+            res.push(fmt_escape_html(permission[show]));
        }
    }
    return res.length == 0 ? warning : res.join(', ');