From 33c79b8bd53b084122b95d8863d776cc6f4a2ad7 Mon Sep 17 00:00:00 2001
From: Dylan Hardison <dylan@mozilla.com>
Date: Tue, 1 Mar 2016 09:48:31 -0500
Subject: Bug 1252437 - XSS vulnerability through malicious bug aliases

---
 extensions/BugModal/template/en/default/bug_modal/header.html.tmpl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'extensions/BugModal/template/en/default/bug_modal/header.html.tmpl')

diff --git a/extensions/BugModal/template/en/default/bug_modal/header.html.tmpl b/extensions/BugModal/template/en/default/bug_modal/header.html.tmpl
index 361b9ec9d..f70e77bb1 100644
--- a/extensions/BugModal/template/en/default/bug_modal/header.html.tmpl
+++ b/extensions/BugModal/template/en/default/bug_modal/header.html.tmpl
@@ -15,7 +15,8 @@
   END;
   title = "$bug.bug_id - ";
   IF bug.alias;
-    title = title _ "($bug.alias) ";
+    filtered_alias = bug.alias FILTER html;
+    title = title _ "($filtered_alias) ";
   END;
   unfiltered_title = title _ bug.short_desc;
   filtered_desc = bug.short_desc FILTER html;
-- 
cgit v1.2.3-24-g4f1b