Jasig/uPortal — pull request #379 by jhelmer-unicon (2014-07-09 05:43:38+00:00)
Title: [up-3315] Fix some XSS issue around inputting usernames.  The issue was ...

...occurring because "" always terminates the

JS block -- even if that's inside a string. The JS interpreter would terminate the block and then misinterpret the unterminated
contents of the string as executable code. The *right* solution for this is probably to start whitelisting the
input characters for every input field. Any field that will be part of a RESTful URL should not be allowed to contain the '/'
character. The "solution" in this commit is intended as a stop-gap. It solves this biggest issue -- the XSS vulnerability --
but it doesn't fully solve the issues caused by invalid chars in the input. IMO, this is better than what we had, but
still not great.
(cherry picked from commit b034dec)