From 11d4d8177c7bd3e18f04b10f7b25c33409bf5fc9 2012-08-13 14:59:59
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: 2012-08-13 14:59:59
Subject: [PATCH] Escape filter values using .text instead of .html.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@10201 e93f8b46-1217-0410-a6f0-8f06a7374b81

---

diff --git a/public/javascripts/application.js b/public/javascripts/application.js
index 5f64c41..7346257 100644
--- a/public/javascripts/application.js
+++ b/public/javascripts/application.js
@@ -130,7 +130,7 @@ function buildFilterRow(field, operator, values) {
 
   select = tr.find('td.operator select');
   for (i=0;i<operators.length;i++){
-    var option = $('<option>').val(operators[i]).html(operatorLabels[operators[i]]);
+    var option = $('<option>').val(operators[i]).text(operatorLabels[operators[i]]);
     if (operators[i] == operator) {option.attr('selected', true)};
     select.append(option);
   }
@@ -151,10 +151,10 @@ function buildFilterRow(field, operator, values) {
       var filterValue = filterValues[i];
       var option = $('<option>');
       if ($.isArray(filterValue)) {
-        option.val(filterValue[1]).html(filterValue[0]);
+        option.val(filterValue[1]).text(filterValue[0]);
         if (values.indexOf(filterValue[1]) > -1) {option.attr('selected', true)};
       } else {
-        option.val(filterValue).html(filterValue);
+        option.val(filterValue).text(filterValue);
         if (values.indexOf(filterValue) > -1) {option.attr('selected', true)};
       }
       select.append(option);