fixin' an xss vulnerability in query_name widget.

13 years ago · c022aeccb2
parent 2e6ebef4cd
commit c022aeccb2
1 changed files with 1 additions and 1 deletions
--- a/lib/widget/controls/query_name.rb
+++ b/lib/widget/controls/query_name.rb
@ -18,7 +18,7 @@ class Widget::Controls::QueryName < Widget::Controls
      options["data-is_public"] = @subject.public?
      options["data-is_new"] = @subject.new_record?
    end
-    write(content_tag(:span, name, options) + icon.to_s)
+    write(content_tag(:span, h(name), options) + icon.to_s)
  end

  def translations