Merge pull request AUTOMATIC1111#13395 from AUTOMATIC1111/escape-names

Fix viewing/editing metadata when filename contains an apostrophe
k1nos · Sep 30, 2023 · 833b9b6 · 833b9b6
2 parents 3b0be0f + d00f6dc
commit 833b9b6
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/ui_extra_networks.py b/modules/ui_extra_networks.py
@@ -213,9 +213,9 @@ def create_html_for_item(self, item, tabname):
         metadata_button = ""
         metadata = item.get("metadata")
         if metadata:
-            metadata_button = f"<div class='metadata-button card-button' title='Show internal metadata' onclick='extraNetworksRequestMetadata(event, {quote_js(self.name)}, {quote_js(item['name'])})'></div>"
+            metadata_button = f"<div class='metadata-button card-button' title='Show internal metadata' onclick='extraNetworksRequestMetadata(event, {quote_js(self.name)}, {quote_js(html.escape(item['name']))})'></div>"
 
-        edit_button = f"<div class='edit-button card-button' title='Edit metadata' onclick='extraNetworksEditUserMetadata(event, {quote_js(tabname)}, {quote_js(self.id_page)}, {quote_js(item['name'])})'></div>"
+        edit_button = f"<div class='edit-button card-button' title='Edit metadata' onclick='extraNetworksEditUserMetadata(event, {quote_js(tabname)}, {quote_js(self.id_page)}, {quote_js(html.escape(item['name']))})'></div>"
 
         local_path = ""
         filename = item.get("filename", "")