Merge remote-tracking branch 'upstream/dev' into nametags_to_value

2026-09-24 16:30:27 +08:00 · 2017-03-06 17:36:04 -05:00
parent 942f0d98d9 e54792f426
commit 278da1b356
6 changed files with 7 additions and 7 deletions
@@ -134,7 +134,7 @@ var View = Backbone.View.extend({
                _.each(option.tags, function(tag){ tags_with_values.push(tag[0] + (tag[1] ? ":"+tag[1] : '' ))});
                var filterstr = _.reduce( tags_with_values, function( memo, tag ) { return memo + tag + ' ' }, '' );
                var filterhtml = '<div class="ui-tags">' +
-                    _.reduce( tags_with_values, function( memo, tag ) { return memo + '&nbsp;<div class="label label-info">' + tag + '</div>' }, '' )
+                    _.reduce( tags_with_values, function( memo, tag ) { return memo + '&nbsp;<div class="label label-info">' + _.escape( tag ) + '</div>' }, '' )
                + '</div>';
                self.data2.push( { order: index, id: option.value, text: option.label, filterhtml: filterhtml, filterstr: filterstr } );
            });
@@ -154,7 +154,7 @@ var View = Backbone.View.extend({
                    });
                },
                formatResult    : function( result ) {
-                    return result.text + result.filterhtml;
+                    return _.escape( result.text ) + result.filterhtml;
                }
            });
            this.$( '.select2-container .select2-search input' ).off( 'blur' );