From 14c16f25ce521486de11228809da2a6c3d4a8def Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Thu, 30 Apr 2015 14:04:56 +0200
Subject: [PATCH] escape html code before output

---
 views/bootstrap/class.Charts.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/bootstrap/class.Charts.php b/views/bootstrap/class.Charts.php
index d3ab00ee6..e7763a263 100644
--- a/views/bootstrap/class.Charts.php
+++ b/views/bootstrap/class.Charts.php
@@ -132,7 +132,7 @@ if(in_array($type, array('docspermonth'))) {
 	var data = [
 <?php
 	foreach($data as $rec) {
-		echo '['.$rec['key'].','.$rec['total'].'],'."\n";
+		echo '['.htmlspecialchars($rec['key']).','.$rec['total'].'],'."\n";
 	}
 ?>
 	];
@@ -169,7 +169,7 @@ if(in_array($type, array('docspermonth'))) {
 	var data = [
 <?php
 	foreach($data as $rec) {
-		echo '{ label: "'.$rec['key'].'", data: [[1,'.$rec['total'].']]},'."\n";
+		echo '{ label: "'.htmlspecialchars($rec['key']).'", data: [[1,'.$rec['total'].']]},'."\n";
 	}
 ?>
 	];