diff --git a/src/main/java/org/olat/core/commons/fullWebApp/_content/nav.html b/src/main/java/org/olat/core/commons/fullWebApp/_content/nav.html index 96eff9ece6ea1d2677319f35051221f05632cd5e..f490822001d2bedd57d0f77e9981c7cfb57ba2fd 100644 --- a/src/main/java/org/olat/core/commons/fullWebApp/_content/nav.html +++ b/src/main/java/org/olat/core/commons/fullWebApp/_content/nav.html @@ -47,7 +47,7 @@ #if($pageTitle) <script type="text/javascript"> /* <![CDATA[ */ - document.title = "$r.translate("page.appname") - $r.escapeDoubleQuotes($r.xssScan($pageTitle))"; + document.title = "$r.translate("page.appname") - $r.escapeDoubleQuotes($r.filterHtml($pageTitle))"; /* ]]> */ </script> #end diff --git a/src/main/java/org/olat/core/gui/render/velocity/VelocityRenderDecorator.java b/src/main/java/org/olat/core/gui/render/velocity/VelocityRenderDecorator.java index df31a79ec832732cf71c5f15dd0dbe9c67169304..99021dbda0a65c1c1b906788a3e30b988bb8a7c7 100644 --- a/src/main/java/org/olat/core/gui/render/velocity/VelocityRenderDecorator.java +++ b/src/main/java/org/olat/core/gui/render/velocity/VelocityRenderDecorator.java @@ -527,6 +527,14 @@ public class VelocityRenderDecorator implements Closeable{ return filter.filter(str); } + public String filterHtml(String str) { + if(str == null) { + return ""; + } + return FilterFactory.getHtmlTagsFilter().filter(str); + } + + /** * @param key * @return