From 5727b7cd73ce72037214d7b2d8d8fe4bcbd11697 Mon Sep 17 00:00:00 2001
From: Jannat Patel <pateljannat2308@gmail.com>
Date: Mon, 25 Sep 2023 22:08:37 +0530
Subject: [PATCH] fix: sanitized inputs for people and course creation page

---
 lms/www/courses/create.js | 7 ++++++-
 lms/www/people/index.js   | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lms/www/courses/create.js b/lms/www/courses/create.js
index fcbb2e27..64984e32 100644
--- a/lms/www/courses/create.js
+++ b/lms/www/courses/create.js
@@ -51,8 +51,13 @@ const create_tag = (e) => {
 	if ($(e.target).val() == "") {
 		return;
 	}
+
+	let tag_value = $(e.target)
+		.val()
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;");
 	let tag = `<button class="btn btn-secondary btn-sm mr-2 text-uppercase">
-		${$(e.target).val()}
+		${tag_value}
 		<span class="btn-remove">
 			<svg class="icon  icon-sm">
 				<use class="" href="#icon-close"></use>
diff --git a/lms/www/people/index.js b/lms/www/people/index.js
index bf018ad2..0e2f2f18 100644
--- a/lms/www/people/index.js
+++ b/lms/www/people/index.js
@@ -36,7 +36,12 @@ const search = (e) => {
 				$("#load-more").removeClass("hide");
 			else $("#search-empty-state").removeClass("hide");
 
-			$(".member-parent").append(data.message.user_details);
+			let user_details = data.message.user_details;
+			user_details
+				.replace(/&/g, "&amp;")
+				.replace(/</g, "&lt;")
+				.replace(/"/g, "&quot;");
+			$(".member-parent").append(user_details);
 			update_load_more_state(data);
 		},
 	});