From 7d2819b3345bbb8fb1aa67af8c6d4ba9dc762670 Mon Sep 17 00:00:00 2001
From: emeric <emeric.poupon@laposte.net>
Date: Tue, 2 Jun 2026 09:05:50 +0200
Subject: [PATCH] Fix XSS when filtering collections with a maliciously forged
 tag, fixes #844

---
 src/lms/ui/Utils.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lms/ui/Utils.cpp b/src/lms/ui/Utils.cpp
index f61dd1f7..7f8edad5 100644
--- a/src/lms/ui/Utils.cpp
+++ b/src/lms/ui/Utils.cpp
@@ -130,7 +130,7 @@ namespace lms::ui::utils
 
     std::unique_ptr<Wt::WInteractWidget> createFilter(const Wt::WString& name, const Wt::WString& tooltip, std::string_view colorStyleClass, bool canDelete)
     {
-        auto res{ std::make_unique<Wt::WText>(Wt::WString{ canDelete ? "<i class=\"fa fa-times-circle\"></i> " : "" } + name, Wt::TextFormat::UnsafeXHTML) };
+        auto res{ std::make_unique<Wt::WText>(Wt::WString{ canDelete ? "<i class=\"fa fa-times-circle\"></i> " : "" } + name, Wt::TextFormat::XHTML) };
 
         res->setStyleClass("Lms-badge-cluster badge me-1 " + std::string{ colorStyleClass }); // HACK
         res->setToolTip(tooltip, Wt::TextFormat::Plain);