Correctly escape names in PMs

This commit is contained in:
Guangcong Luo
2020-02-05 12:00:49 -05:00
parent 6ffe19c254
commit e452b1b730

View File

@@ -196,7 +196,7 @@
} else {
group = '<small>' + BattleLog.escapeHTML(group) + '</small>';
}
var buf = '<div class="pm-window pm-window-' + userid + '" data-userid="' + userid + '" data-name="' + name + '">';
var buf = '<div class="pm-window pm-window-' + userid + '" data-userid="' + userid + '" data-name="' + BattleLog.escapeHTML(name) + '">';
buf += '<h3><button class="closebutton" href="' + app.root + 'teambuilder" tabindex="-1" aria-label="Close"><i class="fa fa-times-circle"></i></button>';
buf += '<button class="minimizebutton" href="' + app.root + 'teambuilder" tabindex="-1" aria-label="Minimize"><i class="fa fa-minus-circle"></i></button>';
buf += group + BattleLog.escapeHTML(name.substr(1)) + '</h3>';