From 7f18a92b7e2aa2aa0a46529028365cabcfaf316e Mon Sep 17 00:00:00 2001
From: liangshiwei <liangshiw@outlook.com>
Date: Thu, 15 Apr 2021 16:12:53 +0800
Subject: [PATCH] Prevent against possible XSS

---
 .../Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/details.js  | 4 ++--
 .../Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/index.js    | 6 +++---
 .../src/Volo.Abp.Identity.Web/Pages/Identity/Roles/index.js | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/details.js b/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/details.js
index 9c6a346921..d16630d7be 100644
--- a/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/details.js
+++ b/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/details.js
@@ -87,7 +87,7 @@
                 data: "author.userName",
                 render: function (data) {
                     if (data !== null) {
-                        return GetFilterableDatatableContent('#Author', data);
+                        return GetFilterableDatatableContent('#Author', $.fn.dataTable.render.text().display(data)); //prevent against possible XSS
                     }
                     return "";
                 }
@@ -97,7 +97,7 @@
                 data: "text",
                 orderable: false,
                 render: function (data) {
-                    data = data || "";
+                    data = $.fn.dataTable.render.text().display(data || "");
 
                     var maxChars = 64;
 
diff --git a/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/index.js b/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/index.js
index 069a3983ec..9fe250b8b9 100644
--- a/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/index.js
+++ b/modules/cms-kit/src/Volo.CmsKit.Admin.Web/Pages/CmsKit/Comments/index.js
@@ -87,7 +87,7 @@
                 data: "author.userName",
                 render: function (data) {
                     if (data !== null) {
-                        return GetFilterableDatatableContent('#Author', data);
+                        return GetFilterableDatatableContent('#Author', $.fn.dataTable.render.text().display(data)); //prevent against possible XSS
                     }
                     return "";
                 }
@@ -99,7 +99,7 @@
                 data: "entityType",
                 render: function (data) {
                     if (data !== null) {
-                        return GetFilterableDatatableContent('#EntityType', data);
+                        return GetFilterableDatatableContent('#EntityType', $.fn.dataTable.render.text().display(data));
                     }
                     return "";
                 }
@@ -109,7 +109,7 @@
                 data: "text",
                 orderable: false,
                 render: function (data) {
-                    data = data || "";
+                    data = $.fn.dataTable.render.text().display(data || "");
 
                     var maxChars = 64;
 
diff --git a/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/index.js b/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/index.js
index d66d7240e3..e25bc64354 100644
--- a/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/index.js
+++ b/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/index.js
@@ -84,7 +84,7 @@
                         title: l('RoleName'),
                         data: 'name',
                         render: function (data, type, row) {
-                            var name = '<span>' + data + '</span>';
+                            var name = '<span>' + $.fn.dataTable.render.text().display(data) + '</span>'; //prevent against possible XSS
                             if (row.isDefault) {
                                 name +=
                                     '<span class="badge badge-pill badge-success ml-1">' +