From 89af582951fcfd43873029cb0ba68e3afe685f40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <barisusakli@gmail.com>
Date: Fri, 17 Sep 2021 11:10:43 -0400
Subject: [PATCH] fix: xss on flags page via ban reason

---
 src/flags.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/flags.js b/src/flags.js
index e119a00e97..0fc8032f2b 100644
--- a/src/flags.js
+++ b/src/flags.js
@@ -776,7 +776,7 @@ async function mergeBanHistory(history, targetUid, uids) {
 			meta: [
 				{
 					key: '[[user:banned]]',
-					value: cur.reason,
+					value: validator.escape(String(cur.reason)),
 					labelClass: 'danger',
 				},
 				{