Sanitize name of sharee

[LukasReschke]

Fixes a XSS introduced with 271684d

@DeepDiver1975 @PVince81 @karlitschek

[LukasReschke]

Gnah - that needs also to get fixed in other places 😠

[LukasReschke]

Ready for review.

I'm annoyed by all those XSS that we had due to the default behaviour being allowing HTML in interpolations. Let's change this for oC8.

[karlitschek]

👍

[scrutinizer-notifier]

The inspection completed: 2 new issues

[ghost]

🚀 Test Passed. 🚀
Refer to this link for build results: https://ci.owncloud.org/job/pull-request-analyser/5608/

[ghost]

🚀 Test Passed. 🚀
Refer to this link for build results: https://ci.owncloud.org/job/pull-request-analyser/5609/

[PVince81]

Shouldn't the escaping be the responsibility of the t() function ?
This is what I would have expected, as I believe the server side translation call also does that.
I might not be the only dev believing that it does, so fixing it in t() should avoid future errors.

I don't think it's good to allow injecting of HTML code with variables like that anyway.

[PVince81]

I quickly grepped the core code and didn't find any occurrence where tags are used as a value.
But other apps might do that.

[LukasReschke]

I don't think it's good to allow injecting of HTML code with variables like that anyway.

ACK. As stated above by me. But I'm not sure whether we should do such a breaking change in the feature freeze.

[PVince81]

Ok, makes sense 👍

Can you make a separate ticket so we don't forget to fix it ?

[MorrisJobke]

#9046