Properly escape user messages (fix popup error)

2018-11-29 21:04:49 +01:00
parent 925ad453f8
commit 05a2aa4aa1
3 changed files with 24 additions and 1 deletions
@@ -537,6 +537,11 @@ LmsApplication::post(std::function<void()> func)
 	Wt::WServer::instance()->post(LmsApp->sessionId(), func);
 }

+static std::string escape(std::string str)
+{
+	return replaceInString(std::move(str), "\'", "\\\'");
+}
+
 void
 LmsApplication::notifyMsg(MsgType type, const Wt::WString& message, std::chrono::milliseconds duration)
 {
@@ -545,7 +550,7 @@ LmsApplication::notifyMsg(MsgType type, const Wt::WString& message, std::chrono:
 	std::ostringstream oss;

 	oss << "$.notify({"
-			"message: '" << message.toUTF8() << "'"
+			"message: '" << escape(message.toUTF8()) << "'"
 		"},{"
 			"type: '" << msgTypeToString(type) << "',"
 			"placement: {from: 'top', align: 'center'},"