From b253e2b02e893fa894a46a21fd0d7167cec25ab3 Mon Sep 17 00:00:00 2001
From: Daniel Dourvaris <daniel@rhodecode.com>
Date: Mon, 24 Jul 2017 12:49:38 +0200
Subject: [PATCH] security: fix self-xss on modifing gist filename.

---
 rhodecode/apps/gist/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rhodecode/apps/gist/views.py b/rhodecode/apps/gist/views.py
index 69bedaa8..f4bcf1ba 100644
--- a/rhodecode/apps/gist/views.py
+++ b/rhodecode/apps/gist/views.py
@@ -378,7 +378,7 @@ class GistView(BaseAppView):
             Session().commit()
             h.flash(_('Successfully updated gist data'), category='success')
         except validation_schema.Invalid as errors:
-            errors = errors.asdict()
+            errors = h.escape(errors.asdict())
             h.flash(_('Error occurred during update of gist {}: {}').format(
                 gist_id, errors), category='error')
         except Exception: