Context-sensitive XSS bugfix.

fatfreecrm · Oct 27, 2018 · 4a57efa · 4a57efa
1 parent 08798da
commit 4a57efa
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/helpers/tags_helper.rb b/app/helpers/tags_helper.rb
@@ -15,7 +15,7 @@ def tags_for_index(model)
       elsif !query.include?(hashtag)
         query += " #{hashtag}"
       end
-      out << link_to_function(tag, "crm.search_tagged('#{query}', '#{model.class.to_s.tableize}')", title: tag)
+      out << link_to_function(tag, "crm.search_tagged('#{escape_javascript(query)}', '#{model.class.to_s.tableize}')", title: tag)
     end
   end