From 207591bfdb74eb470d06f4c41b141dc3a47ab06a Mon Sep 17 00:00:00 2001
From: Kenny <kennyhietbrink@gmail.com>
Date: Fri, 5 May 2017 16:53:28 +0200
Subject: [PATCH] Fix XSS in print page

https://i.imgur.com/gsChT5D.png
When clicking print button: https://i.imgur.com/fH3pc06.png
---
 js/buttons.print.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/js/buttons.print.js b/js/buttons.print.js
index 2352e5ab..871beaf5 100644
--- a/js/buttons.print.js
+++ b/js/buttons.print.js
@@ -3,6 +3,13 @@
  * 2016 SpryMedia Ltd - datatables.net/license
  */
 
+entityMap={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"};
+function escapeHtml(string) {
+    return String(string).replace(/[&<>"']/g, function (s) {
+        return entityMap[s];
+    });
+}
+
 (function( factory ){
 	if ( typeof define === 'function' && define.amd ) {
 		// AMD
@@ -92,7 +99,7 @@ DataTable.ext.buttons.print = {
 			var str = '<tr>';
 
 			for ( var i=0, ien=d.length ; i<ien ; i++ ) {
-				str += '<'+tag+'>'+d[i]+'</'+tag+'>';
+				str += '<'+tag+'>'+escapeHtml(d[i])+'</'+tag+'>';
 			}
 
 			return str + '</tr>';