From 92eee85f3619a1c0593391bb5dfc57a039b9a4ad Mon Sep 17 00:00:00 2001
From: nashe <thomas@chauchefoin.fr>
Date: Mon, 9 Apr 2018 22:08:43 +0200
Subject: [PATCH] Escape data when listing available plugins

---
 src/static/js/admin/plugins.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/static/js/admin/plugins.js b/src/static/js/admin/plugins.js
index 3f88d9b1..c9a24487 100644
--- a/src/static/js/admin/plugins.js
+++ b/src/static/js/admin/plugins.js
@@ -79,12 +79,17 @@ $(document).ready(function () {
       
       for (attr in plugin) {
         if(attr == "name"){ // Hack to rewrite URLS into name
-          row.find(".name").html("<a target='_blank' title='Plugin details' href='https://npmjs.org/package/"+plugin['name']+"'>"+plugin['name'].substr(3)+"</a>"); // remove 'ep_'
-        }else{
+          var link = $('<a>');
+          link.attr('href', 'https://npmjs.org/package/'+plugin['name']);
+          link.attr('plugin', 'Plugin details');
+          link.attr('target', '_blank');
+          link.text(plugin['name'].substr(3));
+          row.find('.name').append(link);
+        } else {
           row.find("." + attr).text(plugin[attr]);
         }
       }
-      row.find(".version").html( plugin.version );
+      row.find(".version").text(plugin.version);
       row.addClass(plugin.name)
       row.data('plugin', plugin.name)
       container.append(row);