diff --git a/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js b/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js index c518659adb..fa3ba0adbc 100644 --- a/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js +++ b/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js @@ -195,7 +195,7 @@ define([ itemTemplate: _.template([ '
', '
', - '
<%= value %>
', + '
<%= Common.Utils.String.htmlEncode(value) %>
', '
', '
', '
' diff --git a/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js b/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js index 02c1e27ece..51fb5b79a7 100644 --- a/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js +++ b/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js @@ -301,7 +301,7 @@ define(['common/main/lib/view/AdvancedSettingsWindow', itemTemplate: _.template([ '
', '
', - '
<%= value %>
', + '
<%= Common.Utils.String.htmlEncode(value) %>
', '
', '
', '
' diff --git a/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js b/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js index b84aff8255..8e06ab2a42 100644 --- a/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js +++ b/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js @@ -239,7 +239,7 @@ define([ el: $('#format-settings-list-code'), store: new Common.UI.DataViewStore(), tabindex: 1, - itemTemplate: _.template('
<%= value %>
') + itemTemplate: _.template('
<%= Common.Utils.String.htmlEncode(value) %>
') }); this.codesList.on('item:select', _.bind(this.onCodeSelect, this)); this.codesList.on('entervalue', _.bind(this.onPrimary, this)); diff --git a/apps/spreadsheeteditor/main/app/view/MacroDialog.js b/apps/spreadsheeteditor/main/app/view/MacroDialog.js index f017d264c3..2239fa12a6 100644 --- a/apps/spreadsheeteditor/main/app/view/MacroDialog.js +++ b/apps/spreadsheeteditor/main/app/view/MacroDialog.js @@ -109,7 +109,7 @@ define([ store: new Common.UI.DataViewStore(), tabindex: 1, cls: 'dbl-clickable', - itemTemplate: _.template('
<%= value %>
') + itemTemplate: _.template('
<%= Common.Utils.String.htmlEncode(value) %>
') }); this.macroList.on('item:dblclick', _.bind(this.onDblClickMacro, this)); this.macroList.on('entervalue', _.bind(this.onPrimary, this)); diff --git a/apps/spreadsheeteditor/main/app/view/WatchDialog.js b/apps/spreadsheeteditor/main/app/view/WatchDialog.js index 72950322b5..65fda80d86 100644 --- a/apps/spreadsheeteditor/main/app/view/WatchDialog.js +++ b/apps/spreadsheeteditor/main/app/view/WatchDialog.js @@ -97,7 +97,7 @@ define([ 'text!spreadsheeteditor/main/app/template/WatchDialog.template', '
<%= Common.Utils.String.htmlEncode(name) %>
', '
<%= cell %>
', '
<%= Common.Utils.String.htmlEncode(value) %>
', - '
<%= formula %>
', + '
<%= Common.Utils.String.htmlEncode(formula) %>
', '' ].join('')), tabindex: 1