luci-base: ui.js: HTML escape custom dropdown values

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2019-07-22 17:18:15 +02:00
parent 86fcf91633
commit a6c538a776

View file

@ -879,7 +879,7 @@ var UIDropdown = UIElement.extend({
else
markup = '<li data-value="{{value}}">{{value}}</li>';
new_item = E(markup.replace(/{{value}}/g, item));
new_item = E(markup.replace(/{{value}}/g, '%h'.format(item)));
if (sbox.options.multiple) {
sbox.transformItem(sb, new_item);