From 7683e37f364d2f40a410842b1e28fe899ff913a5 Mon Sep 17 00:00:00 2001
From: Daniel Wang <dewang@linkedin.com>
Date: Mon, 14 May 2018 14:51:33 -0700
Subject: [PATCH] Escape event notes

---
 src/oncall/ui/static/js/incalendar.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/oncall/ui/static/js/incalendar.js b/src/oncall/ui/static/js/incalendar.js
index b59a291..8369cce 100644
--- a/src/oncall/ui/static/js/incalendar.js
+++ b/src/oncall/ui/static/js/incalendar.js
@@ -1428,7 +1428,7 @@
           if (evt.note) {
             return $('<li />')
               .append('<label class="label-col">Note: </label>')
-              .append('<span class="data-col">' + (evt.note || "") + '</span>')
+              .append('<span class="data-col">' + (Handlebars.Utils.escapeExpression(evt.note) || "") + '</span>')
           }
         })
       )
@@ -1490,7 +1490,7 @@
             .append('<label class="label-col">Note: </label>')
             .append(
               $('<div class="input-col" />')
-              .append('<input type="text" id="inc-event-note" name="inc-event-note" value="' + (evt.note || '') + '" style="width:100%" /> ')
+              .append('<input type="text" id="inc-event-note" name="inc-event-note" value="' + (Handlebars.Utils.escapeExpression(evt.note) || '') + '" style="width:100%" /> ')
             )
           )
           .append(function(){