From 636af7da5a8264789b57501aa594a3905d5d18ab Mon Sep 17 00:00:00 2001
From: Francis Lachapelle <flachapelle@inverse.ca>
Date: Thu, 9 Jun 2016 11:32:46 -0400
Subject: [PATCH] Fix encoding of HTML attributes in Contacts module

---
 NEWS                                              | 1 +
 UI/Templates/ContactsUI/UIxContactFoldersView.wox | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS
index 58b31b738..febbbe8be 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ Bug fixes
  - [eas] when using EAS/ItemOperations, use IMAP PEEK operation
  - [web] fixed recipients when replying from a message in the Sent mailbox (#2625)
  - [web] fixed localizable strings in Card viewer
+ - [web] properly encode HTML attributes in Contacts module to avoid XSS issues
 
 2.3.11 (2016-05-12)
 -------------------
diff --git a/UI/Templates/ContactsUI/UIxContactFoldersView.wox b/UI/Templates/ContactsUI/UIxContactFoldersView.wox
index 44983ff1d..0006fde14 100644
--- a/UI/Templates/ContactsUI/UIxContactFoldersView.wox
+++ b/UI/Templates/ContactsUI/UIxContactFoldersView.wox
@@ -151,11 +151,11 @@
 
       <var:foreach list="personalContactInfos" item="currentContact">
         <tr var:class="currentContactClasses"
-          var:categories="currentContact.c_categories.asSafeJSString"
+          var:categories="currentContact.c_categories.safeStringByEscapingXMLString"
           var:id="currentContact.c_name.asCSSIdentifier"
-          var:contactname="currentContact.c_cn.asSafeJSString">
-          <td class="displayName" var:title="currentContact.c_cn.asSafeJSString"><var:string value="currentContact.c_cn" const:escapeHTML="YES" /></td>
-          <td var:title="currentContact.c_mail.asSafeJSString"><var:string value="currentContact.c_mail"/></td>
+          var:contactname="currentContact.c_cn.safeStringByEscapingXMLString">
+          <td class="displayName" var:title="currentContact.c_cn.safeStringByEscapingXMLString"><var:string value="currentContact.c_cn" const:escapeHTML="YES" /></td>
+          <td var:title="currentContact.c_mail.safeStringByEscapingXMLString"><var:string value="currentContact.c_mail"/></td>
           <td><var:string value="currentContact.c_screenname"/></td>
           <td><var:string value="currentContact.c_o"/></td>
           <td><var:string value="currentContact.c_telephonenumber"/></td>