diff --git a/var/www/templates/important_paste_by_module.html b/var/www/templates/important_paste_by_module.html index d4e6b5dd..061648c4 100644 --- a/var/www/templates/important_paste_by_module.html +++ b/var/www/templates/important_paste_by_module.html @@ -92,7 +92,8 @@ $(document).ready(function(){ } if (final_index != start_index){ // still have data to display - $("#mymodalbody").find("#paste-holder").text($("#mymodalbody").find("#paste-holder").text()+complete_paste.substring(start_index+1, final_index+1)); // Append the new content + // Append the new content using text() and not append (XSS) + $("#mymodalbody").find("#paste-holder").text($("#mymodalbody").find("#paste-holder").text()+complete_paste.substring(start_index+1, final_index+1)); start_index = final_index; if (flag_stop) nothing_to_display(); diff --git a/var/www/templates/search.html b/var/www/templates/search.html index 43459b1f..5ef83daa 100644 --- a/var/www/templates/search.html +++ b/var/www/templates/search.html @@ -196,7 +196,8 @@ } if (final_index != start_index){ // still have data to display - $("#mymodalbody").find("#paste-holder").append(complete_paste.substring(start_index+1, final_index+1)); // Append the new content + // Append the new content using text() and not append (XSS) + $("#mymodalbody").find("#paste-holder").text($("#mymodalbody").find("#paste-holder").text() + complete_paste.substring(start_index+1, final_index+1)); start_index = final_index; if (flag_stop) nothing_to_display();