Merge branch 'escape-label-title' into 'master'

Correctly escapes label title in filters Fixes #15522 See merge request !3880
2016-04-22 15:56:54 +00:00 · 2016-04-22 15:56:54 +00:00 · 7d199b7fcc
parent 10aaea1c91 83adcf19b7
commit 7d199b7fcc
1 changed files with 1 additions and 1 deletions
--- a/app/assets/javascripts/labels_select.js.coffee
+++ b/app/assets/javascripts/labels_select.js.coffee
@ -223,7 +223,7 @@ class @LabelsSelect
        fieldName: $dropdown.data('field-name')
        id: (label) ->
          if $dropdown.hasClass("js-filter-submit") and not label.isAny?
-            label.title
+            _.escape label.title
          else
            label.id