From 951147c6e9fd3bfe19010f2d2ce31cb3f0c9018d Mon Sep 17 00:00:00 2001
From: Max Fichtelmann <max.fichtelmann@procilon.de>
Date: Mon, 29 Jul 2019 17:48:33 +0200
Subject: [PATCH] prevent potential XSS via unchecked use innerHTML

Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>
---
 apps/theming/js/3rdparty/jscolor/jscolor.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/theming/js/3rdparty/jscolor/jscolor.js b/apps/theming/js/3rdparty/jscolor/jscolor.js
index 2bdd4607b4..cad36eab92 100644
--- a/apps/theming/js/3rdparty/jscolor/jscolor.js
+++ b/apps/theming/js/3rdparty/jscolor/jscolor.js
@@ -1100,7 +1100,7 @@ var jsc = {
 				if (jsc.isElementType(this.valueElement, 'input')) {
 					this.valueElement.value = value;
 				} else {
-					this.valueElement.innerHTML = value;
+					this.valueElement.innerHTML = _.escape(value);
 				}
 			}
 			if (!(flags & jsc.leaveStyle)) {