diff options
| -rw-r--r-- | loleaflet/js/toolbar.js | 3 | ||||
| -rw-r--r-- | loleaflet/src/layer/marker/Cursor.js | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/loleaflet/js/toolbar.js b/loleaflet/js/toolbar.js index 94e96e020f..4e493bb507 100644 --- a/loleaflet/js/toolbar.js +++ b/loleaflet/js/toolbar.js @@ -2396,10 +2396,11 @@ function onAddView(e) { } function onRemoveView(e) { + var username = escapeHtml(e.username); $('#tb_actionbar_item_userlist') .w2overlay({ class: 'loleaflet-font', - html: userLeftPopupMessage.replace('%user', e.username), + html: userLeftPopupMessage.replace('%user', username), style: 'padding: 5px' }); clearTimeout(userPopupTimeout); diff --git a/loleaflet/src/layer/marker/Cursor.js b/loleaflet/src/layer/marker/Cursor.js index 592658dca7..6514fc4f25 100644 --- a/loleaflet/src/layer/marker/Cursor.js +++ b/loleaflet/src/layer/marker/Cursor.js @@ -81,7 +81,7 @@ L.Cursor = L.Layer.extend({ if (this.options.header) { this._cursorHeader = L.DomUtil.create('div', 'leaflet-cursor-header', this._container); - this._cursorHeader.innerHTML = this.options.headerName; + this._cursorHeader.textContent = this.options.headerName; clearTimeout(this._blinkTimeout); this._blinkTimeout = setTimeout(L.bind(function() { |