Fix XSS issue in addressbook group name field [CVE-2013-5646] (#1489333)

2 files changed, 2 insertions, 1 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 85963d84f..6a93d40ce 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix XSS issue in addressbook group name field [CVE-2013-5646] (#1489333)
 - Fix attachment icon issue when rare font/language is used (#1489326)
 - After message is sent refresh messages list of replied message folder (#1489249)
 - Add option force specified domain in user login - username_domain_forced (#1489264)
diff --git a/program/js/app.js b/program/js/app.js
index 42c661144..1d1c65172 100644
--- a/program/js/app.js
+++ b/program/js/app.js
@@ -4345,7 +4345,7 @@ function rcube_webmail()
         boxtitle.append(' » ');
       }
 
-      boxtitle.append($('<span>'+prop.name+'</span>'));
+      boxtitle.append($('<span>').text(prop.name));
     }
 
     this.triggerEvent('groupupdate', prop);