diff --git a/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js b/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js
index c518659adb..fa3ba0adbc 100644
--- a/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js
+++ b/apps/spreadsheeteditor/main/app/view/ChartTypeDialog.js
@@ -195,7 +195,7 @@ define([
itemTemplate: _.template([
'
',
'
',
- '
<%= value %>
',
+ '
<%= Common.Utils.String.htmlEncode(value) %>
',
'
',
'
',
'
'
diff --git a/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js b/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js
index 02c1e27ece..51fb5b79a7 100644
--- a/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js
+++ b/apps/spreadsheeteditor/main/app/view/ChartWizardDialog.js
@@ -301,7 +301,7 @@ define(['common/main/lib/view/AdvancedSettingsWindow',
itemTemplate: _.template([
'',
'
',
- '
<%= value %>
',
+ '
<%= Common.Utils.String.htmlEncode(value) %>
',
'
',
'
',
'
'
diff --git a/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js b/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js
index b84aff8255..8e06ab2a42 100644
--- a/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js
+++ b/apps/spreadsheeteditor/main/app/view/FormatSettingsDialog.js
@@ -239,7 +239,7 @@ define([
el: $('#format-settings-list-code'),
store: new Common.UI.DataViewStore(),
tabindex: 1,
- itemTemplate: _.template('<%= value %>
')
+ itemTemplate: _.template('<%= Common.Utils.String.htmlEncode(value) %>
')
});
this.codesList.on('item:select', _.bind(this.onCodeSelect, this));
this.codesList.on('entervalue', _.bind(this.onPrimary, this));
diff --git a/apps/spreadsheeteditor/main/app/view/MacroDialog.js b/apps/spreadsheeteditor/main/app/view/MacroDialog.js
index f017d264c3..2239fa12a6 100644
--- a/apps/spreadsheeteditor/main/app/view/MacroDialog.js
+++ b/apps/spreadsheeteditor/main/app/view/MacroDialog.js
@@ -109,7 +109,7 @@ define([
store: new Common.UI.DataViewStore(),
tabindex: 1,
cls: 'dbl-clickable',
- itemTemplate: _.template('<%= value %>
')
+ itemTemplate: _.template('<%= Common.Utils.String.htmlEncode(value) %>
')
});
this.macroList.on('item:dblclick', _.bind(this.onDblClickMacro, this));
this.macroList.on('entervalue', _.bind(this.onPrimary, this));
diff --git a/apps/spreadsheeteditor/main/app/view/WatchDialog.js b/apps/spreadsheeteditor/main/app/view/WatchDialog.js
index 72950322b5..65fda80d86 100644
--- a/apps/spreadsheeteditor/main/app/view/WatchDialog.js
+++ b/apps/spreadsheeteditor/main/app/view/WatchDialog.js
@@ -97,7 +97,7 @@ define([ 'text!spreadsheeteditor/main/app/template/WatchDialog.template',
'<%= Common.Utils.String.htmlEncode(name) %>
',
'<%= cell %>
',
'<%= Common.Utils.String.htmlEncode(value) %>
',
- '<%= formula %>
',
+ '<%= Common.Utils.String.htmlEncode(formula) %>
',
''
].join('')),
tabindex: 1