From 67653c7a52c3d11000c9b756ef0ead215d64f39c Mon Sep 17 00:00:00 2001
From: mrilyew <99399973+mrilyew@users.noreply.github.com>
Date: Wed, 22 Jan 2025 20:11:09 +0300
Subject: [PATCH] fix(docs): fix doc editing xss

---
 Web/static/js/al_docs.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Web/static/js/al_docs.js b/Web/static/js/al_docs.js
index 98702b787..097b6688f 100644
--- a/Web/static/js/al_docs.js
+++ b/Web/static/js/al_docs.js
@@ -131,7 +131,7 @@ u(document).on('click', '.docMainItem #edit_icon', async (e) => {
         title: tr("document_editing_in_general"),
         body: `
             <p><b>${tr("info_name")}</b></p>
-            <input maxlength="128" type="text" name="doc_name" value="${doc.title}" placeholder="...">
+            <input maxlength="128" type="text" name="doc_name" value="${escapeHtml(doc.title)}" placeholder="...">
 
             <label>
                 <input value="0" type="radio" name="doc_access" ${doc.folder_id != 3 ? "checked" : ''}>
@@ -144,7 +144,7 @@ u(document).on('click', '.docMainItem #edit_icon', async (e) => {
             </label>
 
             <p><b>${tr("tags")}</b></p>
-            <input maxlength="256" type="text" name="doc_tags" value="${doc.tags.join(',')}" placeholder="...">
+            <input maxlength="256" type="text" name="doc_tags" value="${escapeHtml(doc.tags.join(','))}" placeholder="...">
             <br>
             <label>
                 <input type="checkbox" name="doc_owner" ${doc.is_hidden ? "checked" : ''}>