openhatch/oh-mainline — pull request #62 by paulproteus (2012-08-31 21:02:35+00:00)
Title: Fix XSS in map rendering page

If you had a person whose name was a carefully crafted HTML tag, then
the link to the person could include the HTML. This was due to the reckless
use of string concatenation to build HTML from within JavaScript, which is
always wrong.

This fix uses jQuery to build the elements.

It also moves the various variables to only be in-scope within the loops
they are relevant to.

To test it, log into your profile and set your name to be the string:

"">

You can do that at e.g. http://127.0.0.1:8000/account/settings/edit_name