Fix potential stored XSS in Bulk Resize action

verbb · May 22, 2020 · 31c837f · 31c837f
1 parent beb2ee3
commit 31c837f
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/templates/settings/_panes/resize-bulk.html b/src/templates/settings/_panes/resize-bulk.html
@@ -17,7 +17,9 @@
                     <td>{{ item.label }}</td>
 
                     <td>
-                        <div class="btn small bulk-resize-btn" data-id="{{ item.value }}" data-name="{{ item.label | t('image-resizer') }}">
+                        {{ item.label | t('image-resizer') }}
+
+                        <div class="btn small bulk-resize-btn" data-id="{{ item.value }}" data-name="{{ item.label | e('js') }}">
                             {{ "Bulk Resize" | t('image-resizer') }}
                         </div>
                     </td>