From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 13 Aug 2009 14:36:18 +0000 (+0000)
Subject: libs/cbi: properly escape values in dynlist widget (#79)
X-Git-Tag: 0.10.0~1197
X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fluci.git;a=commitdiff_plain;h=6b1be858be3f462d0e81a3fc6c3483041115c046

libs/cbi: properly escape values in dynlist widget (#79)
---

diff --git a/libs/cbi/luasrc/view/cbi/dynlist.htm b/libs/cbi/luasrc/view/cbi/dynlist.htm
index a23a4ebcd..1f3b90141 100644
--- a/libs/cbi/luasrc/view/cbi/dynlist.htm
+++ b/libs/cbi/luasrc/view/cbi/dynlist.htm
@@ -18,7 +18,7 @@ $Id$
 	for i=1, #vals + 1 do
 		local val = vals[i]
 %>
-	<input class="cbi-input-text" value="<%=val%>" onchange="cbi_d_update(this.id)" type="text"<%= attr("id", cbid .. "." .. i) .. attr("name", cbid) .. ifattr(self.size, "size")%> />
+	<input class="cbi-input-text" value="<%=luci.util.pcdata(val)%>" onchange="cbi_d_update(this.id)" type="text"<%= attr("id", cbid .. "." .. i) .. attr("name", cbid) .. ifattr(self.size, "size")%> />
 	<% if i <= #vals then %>
 		<input class="cbi-input-image" type="image" value="<%:cbi_del%>" name="cbi.rle.<%=section .. "." .. self.option .. "." .. i%>" alt="<%:cbi_del%>" title="<%:cbi_del%>" src="<%=resource%>/cbi/remove.gif" />
 	<% else %>