From d72abceee7556c1337e0fde1d04b24b40a554cfb Mon Sep 17 00:00:00 2001
From: John McLear <john@mclear.co.uk>
Date: Thu, 14 Mar 2013 18:18:14 -0300
Subject: [PATCH] escape .color

---
 src/static/js/pad_userlist.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/static/js/pad_userlist.js b/src/static/js/pad_userlist.js
index c8f8e2c9..77ebb190 100644
--- a/src/static/js/pad_userlist.js
+++ b/src/static/js/pad_userlist.js
@@ -116,7 +116,7 @@ var paduserlist = (function()
         nameHtml = '<input data-l10n-id="pad.userlist.unnamed" type="text" class="editempty newinput" value="'+_('pad.userlist.unnamed')+'" ' + (isNameEditable(data) ? '' : 'disabled="disabled" ') + '/>';
       }
 
-      return ['<td style="height:', height, 'px" class="usertdswatch"><div class="swatch" style="background:' + data.color + '">&nbsp;</div></td>', '<td style="height:', height, 'px" class="usertdname">', nameHtml, '</td>', '<td style="height:', height, 'px" class="activity">', padutils.escapeHtml(data.activity), '</td>'].join('');
+      return ['<td style="height:', height, 'px" class="usertdswatch"><div class="swatch" style="background:' + padutils.escapeHtml(data.color) + '">&nbsp;</div></td>', '<td style="height:', height, 'px" class="usertdname">', nameHtml, '</td>', '<td style="height:', height, 'px" class="activity">', padutils.escapeHtml(data.activity), '</td>'].join('');
     }
 
     function getRowHtml(id, innerHtml, authorId)