From e452b1b7305542090825eb6e3ef100befd748576 Mon Sep 17 00:00:00 2001
From: Guangcong Luo <guangcongluo@gmail.com>
Date: Wed, 5 Feb 2020 12:00:49 -0500
Subject: [PATCH] Correctly escape names in PMs

---
 js/client-mainmenu.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/client-mainmenu.js b/js/client-mainmenu.js
index d0e608382..bf3835b5c 100644
--- a/js/client-mainmenu.js
+++ b/js/client-mainmenu.js
@@ -196,7 +196,7 @@
 				} else {
 					group = '<small>' + BattleLog.escapeHTML(group) + '</small>';
 				}
-				var buf = '<div class="pm-window pm-window-' + userid + '" data-userid="' + userid + '" data-name="' + name + '">';
+				var buf = '<div class="pm-window pm-window-' + userid + '" data-userid="' + userid + '" data-name="' + BattleLog.escapeHTML(name) + '">';
 				buf += '<h3><button class="closebutton" href="' + app.root + 'teambuilder" tabindex="-1" aria-label="Close"><i class="fa fa-times-circle"></i></button>';
 				buf += '<button class="minimizebutton" href="' + app.root + 'teambuilder" tabindex="-1" aria-label="Minimize"><i class="fa fa-minus-circle"></i></button>';
 				buf += group + BattleLog.escapeHTML(name.substr(1)) + '</h3>';