From 806a5f209fe0a428c26a8dc0b8dbe3901039bb4f Mon Sep 17 00:00:00 2001
From: jvoisin <julien.voisin@dustri.org>
Date: Wed, 29 Apr 2020 11:33:33 +0200
Subject: [PATCH] Fix two minor xss

---
 cps/static/js/caliBlur.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cps/static/js/caliBlur.js b/cps/static/js/caliBlur.js
index 92ecba28..fc2881ca 100644
--- a/cps/static/js/caliBlur.js
+++ b/cps/static/js/caliBlur.js
@@ -28,7 +28,7 @@ $( 'body.mailset' ).addClass( 'admin' );
 curHref = window.location.href.split('/');
 prevHref = document.referrer.split('/');
 $( '.navbar-form.navbar-left' )
-  .before( '<div class="plexBack"><a href="' + document.referrer + '"></a></div>' );
+  .before( '<div class="plexBack"><a href="' + encodeURI(document.referrer) + '"></a></div>' );
 if ( history.length === 1 ||
     curHref[0] +
     curHref[1] +
@@ -43,7 +43,7 @@ if ( history.length === 1 ||
 //Weird missing a after pressing back from edit.
 setTimeout(function() {
   if ( $( '.plexBack a').length < 1 ) {
-    $( '.plexBack' ).append('<a href="' + document.referrer + '"></a>');
+    $( '.plexBack' ).append('<a href="' + encodeURI(document.referrer) + '"></a>');
   }
 },10);