Properly escape labels in WCF.EditableItemList

see http://beta.woltlab.com/index.php/Thread/2164-Fehler-mit-tags-und-Special-HTML-Characters/

diff --git a/wcfsetup/install/files/js/WCF.js b/wcfsetup/install/files/js/WCF.js
index fb791b37990cd995b5cc82c6c69f071b2164207c..7556454889c5e0235740080da2e90a33714e071c 100755 (executable)
--- a/wcfsetup/install/files/js/WCF.js
+++ b/wcfsetup/install/files/js/WCF.js
@@ -7685,7 +7685,7 @@ WCF.EditableItemList = Class.extend({
                        }
                }
                
-               var $listItem = $('<li class="badge">' + data.label + '</li>').data('objectID', data.objectID).data('label', data.label).appendTo(this._itemList);
+               var $listItem = $('<li class="badge">' + WCF.String.escapeHTML(data.label) + '</li>').data('objectID', data.objectID).data('label', data.label).appendTo(this._itemList);
                $listItem.click($.proxy(this._click, this));
                
                if (this._search) {