From 6b1be858be3f462d0e81a3fc6c3483041115c046 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 13 Aug 2009 14:36:18 +0000
Subject: [PATCH] libs/cbi: properly escape values in dynlist widget (#79)

---
 libs/cbi/luasrc/view/cbi/dynlist.htm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/cbi/luasrc/view/cbi/dynlist.htm b/libs/cbi/luasrc/view/cbi/dynlist.htm
index a23a4ebcd..1f3b90141 100644
--- a/libs/cbi/luasrc/view/cbi/dynlist.htm
+++ b/libs/cbi/luasrc/view/cbi/dynlist.htm
@@ -18,7 +18,7 @@ $Id$
 	for i=1, #vals + 1 do
 		local val = vals[i]
 %>
-	<input class="cbi-input-text" value="<%=val%>" onchange="cbi_d_update(this.id)" type="text"<%= attr("id", cbid .. "." .. i) .. attr("name", cbid) .. ifattr(self.size, "size")%> />
+	<input class="cbi-input-text" value="<%=luci.util.pcdata(val)%>" onchange="cbi_d_update(this.id)" type="text"<%= attr("id", cbid .. "." .. i) .. attr("name", cbid) .. ifattr(self.size, "size")%> />
 	<% if i <= #vals then %>
 		<input class="cbi-input-image" type="image" value="<%:cbi_del%>" name="cbi.rle.<%=section .. "." .. self.option .. "." .. i%>" alt="<%:cbi_del%>" title="<%:cbi_del%>" src="<%=resource%>/cbi/remove.gif" />
 	<% else %>
-- 
2.25.1