HTML-escape torrent name displayed in trackers inspector tab

This will prevent injection of arbitrary HTML when multiple torrents are
selected. Follow-up to the previous commit.

diff --git a/web/javascript/inspector.js b/web/javascript/inspector.js
index 917334dd3e86bb2ad303f14056419f200acc0225..419ad263b7b534c629a7a5329cae31f9d4f3668c 100644 (file)
--- a/web/javascript/inspector.js
+++ b/web/javascript/inspector.js
@@ -716,7 +716,7 @@ function Inspector(controller) {
                        html.push ('<div class="inspector_group">');
 
                        if (torrents.length > 1)
-                               html.push('<div class="inspector_torrent_label">', tor.getName(), '</div>');
+                               html.push('<div class="inspector_torrent_label">', sanitizeText(tor.getName()), '</div>');
 
                        tier = -1;
                        trackers = tor.getTrackers();