From 05b4a4f865c821b4d1780ac4a1f00432534abafa Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Tue, 21 Feb 2023 18:09:13 +0100
Subject: [PATCH] Fixed XSS vulnerability

---
 modoboa/static/js/listing.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modoboa/static/js/listing.js b/modoboa/static/js/listing.js
index e3d6c7b8f..2fc96fbae 100644
--- a/modoboa/static/js/listing.js
+++ b/modoboa/static/js/listing.js
@@ -255,9 +255,9 @@ Listing.prototype = {
     make_tag: function(text, type) {
         var $tag = $("<a />", {
             "name": type, "class" : "btn btn-default btn-xs",
-            "html": " " + text
+            "html": " " + htmlEncode(text)
         });
-        
+
         $("<span />", {"class" : "fa fa-remove"}).prependTo($tag);
         $tag.click($.proxy(this.remove_tag, this));
         return $tag;