AO3-6618 Escape characters on bookmark fields fetched with JavaScript

otwcode · Oct 6, 2023 · c8f8a0d · c8f8a0d
1 parent 660a67a
commit c8f8a0d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/views/external_works/fetch.js.erb b/app/views/external_works/fetch.js.erb
@@ -1,6 +1,6 @@
 <% unless @external_work.blank? %>
-  $j('#external_work_author').val("<%= @external_work.author %>").change();
-  $j('#external_work_title').val("<%= @external_work.title %>").change();
+  $j('#external_work_author').val("<%= escape_javascript(@external_work.author.html_safe) %>").change();
+  $j('#external_work_title').val("<%= escape_javascript(@external_work.title) %>").change();
   $j('#external_work_summary').val("<%= escape_javascript(@external_work.summary&.html_safe) %>").change();
   $j('#fetched').val("<%= @external_work.id %>");
   $j('#external_work_rating_string').val("<%= @external_work.rating_string %>");